Extracted

• • Target
    0cd315d217a2cca7a3a3d74afa7fc92b68e25cc0376c5f70f7647d9279ee9d0f
  • Size 45KB
  • SHA256 0cd315d217a2cca7a3a3d74afa7fc92b68e25cc0376c5f70f7647d9279ee9d0f
  • MD5 b83de5ff87b8e8463649c0e0dc60ef3c
  • SHA1 cfd30f3dc76fcd5c86e6c352fb456e461c1dbbbc
  • SHA512 46ed314b887a3efd4588beee06f532bb7c9b34d2a93c47febd489123687ea0f032fca02fabf46f699d5df0d088eb5cfc1c907d313c3d2010350a5a9f42631f73
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qABw0QbKXPILzjbRgX3iPkEf70QtelBDZcx:UuKWgSJTwRf2Z8L3beXSPlf7ptudcx
  • TLSH
    T105231B003BE9813BF2BE4FB85CF26145467AF6633603D6496CC451DB5623FC68A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2