Extracted

• • Target
    cef74bccf7338cc65a41c6f66a6dd2224fa7fa8f9b9ae666811adea6abb023ff
  • Size 45KB
  • SHA256 cef74bccf7338cc65a41c6f66a6dd2224fa7fa8f9b9ae666811adea6abb023ff
  • MD5 01994838bac846005d85d7e5d5e321ae
  • SHA1 5483ac14ae08d2f3912bb1030d1f0c0d7318bae9
  • SHA512 0e495fbaed878616c4faaa71f9bef8423cad1fe356fab26dce295a449820d1e8f8952d4d36c33e577f21c8448cbebd5d386123d571d6d16adf53135ec8d8c20b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVMw0Q+KXPIBzjbYgX3i0sP5FXXkBDZkx:suJdpTPdI2R9B3bPXS0shVXSdkx
  • TLSH
    T1DF231B003BE8C23BF2BE4B74ACF26145467AF6637503D54D6CC452DB5623BC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2