Extracted

• • Target
    cb8c038167708de1ce47c0e0dcd7d2fbd7ef154635a621a99f8ee8fd21cb327e
  • Size 45KB
  • SHA256 cb8c038167708de1ce47c0e0dcd7d2fbd7ef154635a621a99f8ee8fd21cb327e
  • MD5 5ccaaa1645e62e85a376bf6f67bb4a32
  • SHA1 363b1b665da620b7ae5844e0ab81adb30bf55bea
  • SHA512 083ffc01c02ab5fb34b8fc341bec8783b6c74ac8b6e7fee945cade7327611f5018d5776a22777c27950399caf6dbc9881b2840ee5cf5d0e205eec6a9e4c69965
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97S7synzuOPIzzjbtgXKiiPc/eSbDH6Xwh8BDZsx:EufspTf2g22SYh3z3b6XziZSaXwodsx
  • TLSH
    T137231A0037E8812BF2BE5F78A9F26145867AF6633603D64A1CC451DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2