Extracted

• • Target
    cc5adae51dee87235a7a2e70e12c0e2a6be8a319a5e6bf9313510b494180af84
  • Size 45KB
  • SHA256 cc5adae51dee87235a7a2e70e12c0e2a6be8a319a5e6bf9313510b494180af84
  • MD5 75e78e93d94c3950e4ce909f86842c2e
  • SHA1 029a9180c350b6398cfbb2225bdd3b9c0faa096d
  • SHA512 a88118a2e48d13a59aba3cc654c23833963a489f5235ba6a1b72a8be4750d16980f6d1f66387af7dec08720223608b4c5ec3bc9a67b2d7bd407c9b120e3d020c
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAeb30GYjHuPI8zjbegXZiegVJ5lSniUkDBDZcx:UuKWgSJTwRf2uw/383bhXoeU5lSniU2s
  • TLSH
    T1AB232B003BE88127F2BE4FB8ACF26245467AF5737602DA4D1CC451DB5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2