Extracted

• • Target
    cc1ca6eb2eeb0d53b50a3828dbda47c32c470d1977641c68a9e95ac2bb491c3c
  • Size 45KB
  • SHA256 cc1ca6eb2eeb0d53b50a3828dbda47c32c470d1977641c68a9e95ac2bb491c3c
  • MD5 bb315b85854877adc06f1a94bd8bf3e6
  • SHA1 3f286824307ad6582afcc01df1518d2a72839d86
  • SHA512 57be38cce03cd89e2f3a70ea475ac45fd44ad00197f1471e9dcd959065812254d17ffb47a7c948227efafb80953dcf124d6edb2273ca507b596595221e22a449
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozfy3CKPItIjbfgX3i+qBwh6N5boxBDZsx:EufspTf2g20TRtgboXS+qBwgVoPdsx
  • TLSH
    T126231A1037E8C12BF2BE4F7899F26145467AF6673A03D68D1CC411DB5723BC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2