Extracted

• • Target
    cd503081e54afbb98427fb20915021d8b6eb2658cb158460a8d2194b4bc06127
  • Size 45KB
  • SHA256 cd503081e54afbb98427fb20915021d8b6eb2658cb158460a8d2194b4bc06127
  • MD5 8d2cfc23f8de74108dd500f75e68eade
  • SHA1 0b802e9bdad343fb22072431c2dcc12b9fd18a10
  • SHA512 f0ff3ce35faa17cd80233e7159e492c02051ca6bdd34495d00e2603d0757f2c5af6855719c6761b804af0abe5fb9b1ebddcc29220a178775dff6eb9750775889
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQfUJ+XOoJ9hU/NPIEfzjbmgX3il0CAVeERwkOFuBDZW:cuqb5TrhG2TU0eI9hyqEf3b5XSa3Wkc7
  • TLSH
    T195231B003BE8C13BF2BE4FB85DF26145867AF6636603D55A1CC4519B4713BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2