Extracted

• • Target
    cbed68768598ea853d5021245e08566a06939630b3b088836cfde5705d8844a0
  • Size 45KB
  • SHA256 cbed68768598ea853d5021245e08566a06939630b3b088836cfde5705d8844a0
  • MD5 e76b63683d7bdfc85e73e174a1b26227
  • SHA1 2bc16dfa2074119b39aa4314be7be0c1bfc9b0e8
  • SHA512 b5f449427925aeb50f43f885712420e5016ffbb7514ef039de7f5008df91962ec30aae1ae03422b17ec1094de82ba65eb5b0968353d2a7d712c6c6b6997eadf5
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIvtjbygX3ixkmGA5B02JBBDZUx:cu7e5TH2A2q4EaHvlb1XSxCA/LdUx
  • TLSH
    T19C232B003BE8812BF2BE4FB859F26145467AF6733603D5492CC451D75713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2