Extracted

• • Target
    ccc63a45248af6807055a5661c43c903cbfe8dd73fcdb7ff13a548ae0ba93dd6
  • Size 45KB
  • SHA256 ccc63a45248af6807055a5661c43c903cbfe8dd73fcdb7ff13a548ae0ba93dd6
  • MD5 03b1366092da3bcbb93cf1ec35d749ea
  • SHA1 a578703e15ff0ff90a1520443a36bd046914729f
  • SHA512 2188c36730c54b5234cc6ce1ea09fbfe95fac553abd6e19052a3632a5ebcf80b022eb89294981eb28e6f133b5f90a1917557df3556d216f7bb13f75e63fab90d
  • SSDEEP 768:0uAVhJTDEQAQWUaDyzWmo2q7dwzBNMwpGPIMPzjbZgX3XMfnSMeMDv66PydeOFLz:0ushJTDXgH2oWGYvMP3b2XnMf7lPmeyP
  • TLSH
    T1DE232B0037E8C22BF2BE4FB898F26145867AF6632603D54A1CC451DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2