Extracted

• • Target
    cb11d82076953eb9e6fe9de3e9155ecb05a0c11dd6cdd3fc019727ffe49192d5
  • Size 45KB
  • SHA256 cb11d82076953eb9e6fe9de3e9155ecb05a0c11dd6cdd3fc019727ffe49192d5
  • MD5 649de29b445ba37b39c06eae70d47961
  • SHA1 0dee37ce9b9bfa3c8e4675a893364834124aeeff
  • SHA512 b94949db39fe8d3b03c54c72ce821356504d1909725daf93480f6ba644df450302d274fc1570ff1cbae9693e8c0a307e891e84500364f55ccd2d3fab7a069271
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ0fBohEa+PIvujbPgX3ihK2fGtOoW0nCBDZUx:cuqb5TrhG2a4EaHvCb4XS7fGsHE8dUx
  • TLSH
    T1B4231A003BE8812BF2BE4F7898F26145467AF5A36603D54E1CC442DB5B13FC6DA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2