Extracted

• • Target
    cdc011021a66e98a86dbecd9593367f7adb771a638c5c372e59432c3406ffe09
  • Size 45KB
  • SHA256 cdc011021a66e98a86dbecd9593367f7adb771a638c5c372e59432c3406ffe09
  • MD5 103b2725896976393273b66ca5f3ba7a
  • SHA1 95a0febc60684fc726e9b07a5240a89890785ac5
  • SHA512 106e9be052527d7c9f445e35b018ff221ce4cd181cdf918e480d3a1d8109a1be99fa6a3eed3c0fd8eebf40450cb76bb4c4f81772122fc98550bc9e6141c6b733
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIkNjbEgX3i+hvuE7O1DD8OU+BDo:kuSOpTPOP2x/CFWBkFbLXS+wFdMx
  • TLSH
    T1F8233A0037E9812BF2BE4B78A9F26245867AF5733603D54A1C8441DB5B13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2