Extracted

• • Target
    cffd55e23ef30537e2078ea18c70de935c532a7e7c2d03c9e489acd1a08ea60f
  • Size 45KB
  • SHA256 cffd55e23ef30537e2078ea18c70de935c532a7e7c2d03c9e489acd1a08ea60f
  • MD5 c1c7767c2edd27a646f1316e73c70524
  • SHA1 bc0ed368f45fa446fe1e920c5a708c3a52b51c98
  • SHA512 eff194767af0166c32b7e4095645dded6dfc2e270da6f2ec3d4d3730d754ad9280fe82e07188b28510adff735ef516ab4a80b8c4945a45ea4734d7cc2c4a62f4
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4ziD8yfzuOPIlzjbegXJiE3FdLLKrkL2FBDZ0x:8uUIpT4vAj2niAJ3l3bhX4Y9Kr9d0x
  • TLSH
    T1E8233B003BE8812BF2BE5F78A9F26145467AF6633603D58A1CC451DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2