Extracted

• • Target
    04cf00bc1d538ce2c8f16c88ce11315eceefe443b7a416f8f8d3dda45a8956f0
  • Size 45KB
  • SHA256 04cf00bc1d538ce2c8f16c88ce11315eceefe443b7a416f8f8d3dda45a8956f0
  • MD5 fddf8dfe8a18f1b51d5cfd37e771ba36
  • SHA1 5d0c8e3dfa7134151578f5bf2ffb71ff8b8f7be3
  • SHA512 46659bd1fa98a93ad8033c0e433457a9af4232d4a91edfd63f0410121873532a3d842d7e9c312122c59a6d3a16ea5a126c53bc96293a0ef578e3b177c47fbfd7
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFCm//GgrOPIm8zjbogX3iww6GGs/wsBDZUx:cu7e5TH2A2pmHb3Z3b/XSqf8wqdUx
  • TLSH
    T155232B003BEC822BF2BE4F7899F26105467AF6A37603D5491CC452DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2