Extracted

• • Target
    cfe9f58f3adf2c75dfd7f96d3dceca7501fa27afc6062e57604bd3bac7e51649
  • Size 45KB
  • SHA256 cfe9f58f3adf2c75dfd7f96d3dceca7501fa27afc6062e57604bd3bac7e51649
  • MD5 457bd436202fd27451350e29de49ba92
  • SHA1 824ac1f8ed4f1d39b7af94d069034010ffa591f0
  • SHA512 a78059df7f24d3438e8a5d4e2a2456ec19421b7bcd814ffc51bef4c6ff2b98aba94e48eb92c8bd832386e90e116dda6cee81c7a037ce1f188b4e38cd31aeb695
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q16T2QAm7PI1mjbXgX3iSB536YBDZcx:RuxkJTgip2mT1KbwXSSBF6edcx
  • TLSH
    T1DE232B003BE9822BF2BE4F7858F26145867BF2637603D5492CC451DB5723FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2