Extracted

• • Target
    cf40f59fcc6d4ba68d5d55160801958cb19d7ddc4b55b79bb1d124d99810913f
  • Size 45KB
  • SHA256 cf40f59fcc6d4ba68d5d55160801958cb19d7ddc4b55b79bb1d124d99810913f
  • MD5 11c204d8cc4b534beaed6fe18dd5433b
  • SHA1 166a1aba394794c98133db4f9b4476eb867b741a
  • SHA512 92eef8f02febd065a402bff47ea141e450fa2a3faa7c244c4f7355bf62ade9b42ad72c60eab2050867d42c233ea0761b70fd703f9117fd7fd86bb7d527cb2ecb
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql23XoPEayPIRzjbhgX3iQ6H1prLXYBDZMx:wuDWZTpMZSB2lmEabR3bOXSBVxedMx
  • TLSH
    T135232A003BE8C22BF1BE4FB89DF25245467AE6737603D5492CC4429B5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2