Extracted

• • Target
    cdb759c524966cff3d0f9d75b04f34e5e113c20ac794a3066d55d33a55802142
  • Size 45KB
  • SHA256 cdb759c524966cff3d0f9d75b04f34e5e113c20ac794a3066d55d33a55802142
  • MD5 65894df5d704e1275fcf4d476d7f6605
  • SHA1 7d04254956480b5e3c9e1b81db19a58e84c8f3a2
  • SHA512 6ec225a20973eec08424dfb9b8dbf718c73080a6ec8ae20a879994ae0a4fed947292c69a77005a8d5bb95d5c76eb14c1a006f447c90ee879c1bba0540dc28930
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAbgzZUpx7PI8HjbsgX3iCTUNbdkDWDLM4BDZcx:UuKWgSJTwRf2ron8DbjXSCTPB+dcx
  • TLSH
    T18A2309003BE9812AF2BE4FB8ADF26145867AE5633603D5492CC451DB5723FC6CA426E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2