Extracted

• • Target
    ceaceb909c7a4d93262f98ae045bb56af83cd3120e11f135b49592bcf3505bca
  • Size 45KB
  • SHA256 ceaceb909c7a4d93262f98ae045bb56af83cd3120e11f135b49592bcf3505bca
  • MD5 e309810a25d480d379c557f05ea772d9
  • SHA1 efd6ba9e262f30f791c4d73b71ca6f3242dbaec3
  • SHA512 86da8725dcd10c7e64bf13608cdbaad3e31194cea88736304a2d83d343eb9898428e285d9dc2101e51c40272ff3293e384b4d4554e00fb7be877fc8a5f778720
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q12FpPklON8APIDzjbsgX3iu6bJKpd09dBDZUx:cu6YepTPso2f7kwN8lD3bjXSJgpd09z0
  • TLSH
    T159231A003BE9813BF2BE4FB899F26145867AF1776602D54E1CC452DB4623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2