Extracted

• • Target
    c56e9fc2f560a5246ff5c204ab8eabfe2e2a4076ecbdb0223e286f13575611a9
  • Size 45KB
  • SHA256 c56e9fc2f560a5246ff5c204ab8eabfe2e2a4076ecbdb0223e286f13575611a9
  • MD5 ebdf3d79f37de129f0ac2f39b48e1c99
  • SHA1 6001d9b835f15dab8ddba6776ff79331abcb4c2e
  • SHA512 85ceee2109cd568d85d6e8a9336e2706d4bc304484f450d94599203bc2b9b7f6ea8b743552a7da91b6d0ecd0aa69c58f9fb39b8284474bd9d6bf039b5b436c0d
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIIzjbOgX3iuFQNL+w79EFSMdpW:cuR0JTPjY2SL9wQPI3bxXSu8aw7qcMrW
  • TLSH
    T1AB23090037E9812BF2BE4F78A9F26145867AB6733603D6491CC451DB5723BC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2