Extracted

• • Target
    cda9df398777df5f01532c0a8d91a5c2433bbec8fa30ab0d21fdbf11d5126d42
  • Size 45KB
  • SHA256 cda9df398777df5f01532c0a8d91a5c2433bbec8fa30ab0d21fdbf11d5126d42
  • MD5 fc660beb5aa0264646fc1988f9179397
  • SHA1 60e6afd0bf2a4cf919f061329ab6bf2ba7595dd6
  • SHA512 a64401e9fb6e91c771b35913ec31820a317ffd18751002c55f0dc5175edc568ed2caf4d41c063187b7f1143cb2b030925c21761b1a33ad92cd90b9835df3d858
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVuoCa/ld3APIXzjbfgX3Nva16Wy7tBDZkx:suJdpTPdI23E/T3lX3boX9vAHUdkx
  • TLSH
    T132233B0037E9813BF2BF4F78A9F26245467AF2637603D64D1CC451DB5623BC29A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2