Extracted

• • Target
    cca9e4ad2971a7e9bd338a6f0a566ff42495114da61d7b38e36adb0bb0bca8ce
  • Size 45KB
  • SHA256 cca9e4ad2971a7e9bd338a6f0a566ff42495114da61d7b38e36adb0bb0bca8ce
  • MD5 ccf5a64882b3d558fc7f29d582d520ce
  • SHA1 7354773d7d9cc23f200cf51a5054c83315fceddc
  • SHA512 e4fa185180695420b34b36f3f2fb7650155c8de146078e9e81e0c0343d07220f6aa641015c2c48234763a7a27dcd8d7f9f05e0f0f3ec673a9fa3aa40cafdd024
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtOdR3aI6OPIuzjbYgT3ieGVGnWPQjrKKGJtBDZ0x:5udApTNmU2hjqb3u3bPTSeGwAQjrK9jU
  • TLSH
    T153233C0037E8812BF2BE5F78ADF26145857AF5673A03E58E1CC4519B4613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2