Extracted

• • Target
    cf0e3b944e19b7311bf0aa3271c900a062a9686817cd851e53995d21df35fed3
  • Size 45KB
  • SHA256 cf0e3b944e19b7311bf0aa3271c900a062a9686817cd851e53995d21df35fed3
  • MD5 bdc59e370c067a310b5bc1cb442369fa
  • SHA1 a1ef9185f359d2f92c48da946b2998d41b196ddd
  • SHA512 8c11e68d1cd8cf7500ea893dd1151d9033e28ab630980bde4ca298946997675d805256764dad858ba2ed19d0b08f74a617b83373645e57a64b5315faa53c942a
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlVl9fcBEahPItzjbQgX3iqZJ6FkWHCVcVp3TBDZO:wuDWZTpMZSB2cLkEa+t3bXXSC6FkWiVX
  • TLSH
    T187233B003BE9822BF2BE4F789CF26245467AF5B33603D54A1CC452DB5613FC696426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2