Extracted

• • Target
    cce110adbb46d244e829948ca7c0316cdbc44c631f46e4c499f560bd17f9f490
  • Size 45KB
  • SHA256 cce110adbb46d244e829948ca7c0316cdbc44c631f46e4c499f560bd17f9f490
  • MD5 bac3dcddae73ff731b24f4141d98cc0b
  • SHA1 e8d38d149be84d30620354bc91146ea2b7dec295
  • SHA512 6db186b10a25d25553ecf6d37da29c5f3e8507c58428f4015961925b1db469a2537d19688b1ebe065c729bffcdd685bc3718e7fe020969b31b9771076709cedb
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ43HE4eVoOPIGjzjbxgI3i3VdzER0bwb2eITBDZUx:cuqb5TrhG2UU1o3Gj3b+ISHEKwbodUx
  • TLSH
    T172231A003BE8812BF2BE8F7898F26145467EF6A33603D5491CC451DB5723BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2