Extracted

• • Target
    cfc30b1757025439dcf0e790a1f304b00a04509cb5d5af6aaa0c6e5606ed997b
  • Size 45KB
  • SHA256 cfc30b1757025439dcf0e790a1f304b00a04509cb5d5af6aaa0c6e5606ed997b
  • MD5 3cdc26d99136f7147a449c86c40012cd
  • SHA1 2a2bebaf5c356ddc499aef1ca02933f0c759a38b
  • SHA512 a49d43a206eda44947757a56b0415084d794a71a4503b01f25d57c59854a710ad5bff89f14c4b0f41cc8341014da148023ceca71a37ac70c1ca3623cd62eeb0f
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj4ozHyvCKPIiAjb1gX3i4J8VUzahU9TGBDZ8x:0u2vpTDe+22L5iobSXSUbahhd8x
  • TLSH
    T1B22319103BE8C12BF2BE5F789DF26105867AF5632A03D54D1CC4529B1613FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2