Extracted

• • Target
    cb7c2c04584ea2bf3dc50220fe495d4199edbb8df34a00ed117754ef1bf326e6
  • Size 45KB
  • SHA256 cb7c2c04584ea2bf3dc50220fe495d4199edbb8df34a00ed117754ef1bf326e6
  • MD5 67777918bf24a35ccce441a67962aaa1
  • SHA1 d68ab21eb09515fa21094c399d632d6f19ea46ce
  • SHA512 ccbadd1936d0c2cef541465cdbde360fdf14b584b5dcdfbf3f748d8216efcd5fa168f25ec2b0c04d7a114ec24b245ec3d0df5f29cb3bc0c5d48ae379fa66c0eb
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1zGsGx8OHuPI2zjbugv3iwo4lbS1kxD3xyaVUBDZcx:RuxkJTgip2+ez323bRvSwo4lyiyaVide
  • TLSH
    T1B1231B003BE9813BF2BE4F7868F26145467AF5637603D5492CC452DB5723FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2