Extracted

• • Target
    cff05c2fd343c32d7b262f6f5365cc88b09b204077dc303209ce7a50866d2ade
  • Size 45KB
  • SHA256 cff05c2fd343c32d7b262f6f5365cc88b09b204077dc303209ce7a50866d2ade
  • MD5 fa7e9a1fdb642381cc3214c07a1fac83
  • SHA1 1ca9fdbddea89492eaf89404d111ef6bf1c55090
  • SHA512 dcc4418f64c4c7d6de656bc205a1934c6211e3f3eff6c7c241f95e490c08d01c4688e95a719c491c2b1cf98d8d4f9c9d2efc610019df023eff7675bed4d02b41
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtgDEbHBqj2OPI/pzjbegX3i+FoIsO+sd3VyeDBDZ0x:5udApTNmU2fyoK3/p3bhXS3q+SlyeFd2
  • TLSH
    T113231A0037E8C22BF2BE4F78ADF26145867AF6633602D5491CC4519B5623FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2