Extracted

• • Target
    ccffd2c799dfaa416e85e05d21e0afba4b3d7dd8365dd726d52da3ee60f83e87
  • Size 45KB
  • SHA256 ccffd2c799dfaa416e85e05d21e0afba4b3d7dd8365dd726d52da3ee60f83e87
  • MD5 1947fb88426f64031e76ce17bbb6e3e2
  • SHA1 1e2ecc09e25af78596fbd7c56a2cbd441e17191b
  • SHA512 0e20ac2b9deb96c2e7be89c59d425942deb9b8da3d4c501312894db8577bc7f79ed4315b3e35881d90c008391f30a49376d6df4ae4ae58fa2009c7a0fb62ed1c
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtxW8aIXOPIKzjbkgN3ivLn17sdU6Y9BDZ0x:5udApTNmU2tFu3K3brNS7Rse6ed0x
  • TLSH
    T101232A003BE9822BF2BE5F789DF26145467AF2673603D68E1CC4429B5613FC58A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2