Extracted

• • Target
    cfd100f0745d7a0424f37de5bd354a47b5d7a90074284ff6026593c9856d2e26
  • Size 45KB
  • SHA256 cfd100f0745d7a0424f37de5bd354a47b5d7a90074284ff6026593c9856d2e26
  • MD5 c30833811d3c10ebcdcf0ffcd30b45a9
  • SHA1 8885d58c8dd9ae6f10e47accc5bd0c65529fbfc5
  • SHA512 8383d60596b373a55b236a5902c341e35d729205e9185df135c7481e8e86230e411b319efdb2d0f99d5c0c66fdbaf36a7fd9af0d2175453287ed32369d38597f
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFKNd3u40cMOPI08zjb5gX6iRW+h+40Gv1nBDZUx:cu7e5TH2A2R8+M3083bWXDy4/9BdUx
  • TLSH
    T194232B003BE8812BF2BE4FB899F26145867AF6732603D54A1CC451DB4713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2