Extracted

• • Target
    cf96b39d28db18364e678b34cb19a698185e01a91954b7521837c69e83e54d7a
  • Size 45KB
  • SHA256 cf96b39d28db18364e678b34cb19a698185e01a91954b7521837c69e83e54d7a
  • MD5 a2291584859976f99d0525175bc88465
  • SHA1 c72849a895bd7cc5faef6557cb00c5e44355d368
  • SHA512 b183fcaf5bf1e47babfc8532e87d00609148a62d43377424369a6c404451ba32caf1afe0510200a12386ba43e2ae92edbdace299854f366111c7ea5c2befe7f2
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA1cP0pycvHPIjzjbsgX3iRuBCsb6br3BDZMx:kuSOpTPOP2FccMcvgj3bjXSYVbirxdMx
  • TLSH
    T14D233B003BE9823AF2BE5F7898F25145867AF2733603D54A1CC451DB5623BC69A836FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2