Extracted

• • Target
    cbd925138aa579ccaa0e3f046e18e97933c1104ea69e4f71a7b6ad2427a4bd6a
  • Size 45KB
  • SHA256 cbd925138aa579ccaa0e3f046e18e97933c1104ea69e4f71a7b6ad2427a4bd6a
  • MD5 4c25c6bfeb596e0e198f5d93866a644d
  • SHA1 cae2951118daf86817ef3294332254135529e112
  • SHA512 58547c4e09f48977acc26284db0c025e80f5f3e928c3afd20ce827ed7d327ce6e40ab967cc86b007faabdec8d6c88ee0479469ded238e5282aad2124148d1958
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvNjbigX3iZzCwvN9Dqb8O9nBDZEx:MuLAZTnbg2Z4EaHvFbFXSZzCwl8wKdEx
  • TLSH
    T13E232A003BE8822BF2BE4B789DF26145857AF5636603D68E2CC411DB5713FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2