Extracted

• • Target
    cb4c32d6e9c1220d797fc6f14518ce610e94ff059444cdce4c8221d3b33e6cc3
  • Size 45KB
  • SHA256 cb4c32d6e9c1220d797fc6f14518ce610e94ff059444cdce4c8221d3b33e6cc3
  • MD5 197809fe0b0a5d1e3477969343b64aec
  • SHA1 fbc802fe88e6a40c85f16b6ab84f32fbe0db5540
  • SHA512 1299bd454bffccbf8d5bd968bcecd5b22a3b848aecb4e7e062268d215816fe9e7c88972beb1fd18faf54e4bc0fcbd31fe092538d1f55419afa1ed8bf3a010627
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXmaPclm3API7zjbbgX3i/Jcg+Uquw+a0Kk4aBDZm:vuogpT7I62IfcE3l73bkXSRFk0Bndkx
  • TLSH
    T14F231B003BE9813BF2BE4B7899F26145867AF6637603D54A1CC451DB4723FC28A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2