Extracted

• • Target
    cf420134b032ecc4a75f9bbdb225900741353fd28e610d778249758643158e14
  • Size 45KB
  • SHA256 cf420134b032ecc4a75f9bbdb225900741353fd28e610d778249758643158e14
  • MD5 d17dcdb589f12a413603607a443dc225
  • SHA1 10a15d548b2769752012259f20a3124a1654589a
  • SHA512 a62bd8f833fe8ff233325a36d72d52a20a36af3c4e7d46a862118eedfb1b8f2526f4aa67ae6af8ff7990cebffff5d42a475e0a54bbcdc6acc73c28c0516256c1
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm/9GgrOPIRzjb2gX3i9qWOPVuBDZEx:MuLAZTnbg2um1b3R3bpXS9qWTdEx
  • TLSH
    T156231B003BE88127F2BE4F78ACF26105867AF6677603D54A1CC4529B5613FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2