Extracted

• • Target
    cf2a693e0350c74d7e1547a1e45dde7f433c667b93f371632887ba970dceef55
  • Size 45KB
  • SHA256 cf2a693e0350c74d7e1547a1e45dde7f433c667b93f371632887ba970dceef55
  • MD5 8ae445f0109bad60538239847d256f64
  • SHA1 3ab0acd300e134cc5849a4b857a2a161c4459a5f
  • SHA512 08ed2530d3c6b3db0cf359337c646a4f2b40d9fd97cb5b366f03bb626b2800e4843f17db36e7b55eeb3239c5173d2ee467b858e16714c200254f5c4db528b8c7
  • SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbxgX3iSFRvhMcBDZwx:guKWgSJTwRf28j0/OghlTp3b+XSSLO6Y
  • TLSH
    T199232A0037E8812BF2BE4F78A9F26145467AF5637603D64A1CC441DB5723FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2