Extracted

• • Target
    ced6507bdf8ed1cdf33b72339774a8141550a4981a24b9abc91ba0e6e98e4d49
  • Size 45KB
  • SHA256 ced6507bdf8ed1cdf33b72339774a8141550a4981a24b9abc91ba0e6e98e4d49
  • MD5 fea19bd5958724080cd1893ba7b6d57b
  • SHA1 3b8b5d8469fba0161e5ee6be0a1f798e767ae982
  • SHA512 5763383085656b00758ef15999930afde0a771cab9d4617e6251b87a895e16d54924ad30055f20b7183048874c6d8846a3767ce17a8101425f9d6356e20d2bc5
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1W/qpG3jHuPIszjb8gXLiHrRE49FshVKHABDZUx:cu6YepTPso2zIM3s3bTXGHvUhVyWdUx
  • TLSH
    T1EA2319003BE9812BF2BE4FB4A9F26145867AF1637603D64D1CC451DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2