Extracted

• • Target
    cfbbba5e506fabd3037463e5556e5328449faecd5b3fc4cff8148a543a0e5d12
  • Size 45KB
  • SHA256 cfbbba5e506fabd3037463e5556e5328449faecd5b3fc4cff8148a543a0e5d12
  • MD5 445d149c4d46e061fa3e8002a704b5f0
  • SHA1 65b8a0db744a0dee839fb8bb25b4d526b637b0ee
  • SHA512 ade934a8ab2483949c64be5ac4b050d9fb2488a2a039072c05c672cb0e7e159207cf83b63087f2cd2a39d24675b1ef4db0dca7868027f317081335e98a681e79
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFVlspcPEaPPI84jbHgX3iCUTfW1gRBDZUx:cu7e5TH2A2UgaEaI8wbAXSCUTfnvdUx
  • TLSH
    T14E232A003BE8822BF2BE4FB89DF25145867AF6636603D54E1CC411D75723FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2