Extracted

• • Target
    cc8df2b36683ed653fd297693b7057ab2d03ac4e838be10c2860e4a94fb613a0
  • Size 45KB
  • SHA256 cc8df2b36683ed653fd297693b7057ab2d03ac4e838be10c2860e4a94fb613a0
  • MD5 af32b295370b22955ed423d7058c25ff
  • SHA1 d2415716738f972843dd3c34e67695ad4677b0e0
  • SHA512 1a87bb0832857343699cf3992931589e6cc27080cb60827ff114e1d2abee6e9bf626c9d68d416feea1dff36cb75d8741c5079a7a62062f2fac65ca613970b127
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlI3Xo5EayPI8zjbNgX3i9SoZyNiPoTzBDZMx:wuDWZTpMZSB2jQEab83baXS9jyNWopdO
  • TLSH
    T1AD231A003BE8822BF2BE4FB8ADF26245457AF1637603D5492CC451D75713BC69A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2