Extracted

• • Target
    0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6
  • Size 45KB
  • SHA256 0cffa58e15617cf0af06fbd95dab1fc0bd4c5da1243af351df25379928f554f6
  • MD5 083a1b22a416a7ee8807ce3c6aacf4e5
  • SHA1 930d63e2a4b7ccca9ca3afd5b480ce11246fa2b0
  • SHA512 c6108e4b503b7b3c52d0879ea5f71f9a5783242eb670b9f08d299fbf498a00705b9de915d6ec20c4f15d281e151e34c1443464adb1f857a4d60d99a126717734
  • SSDEEP 768:guKWgSJTwU6NkWUGnaSmo2qAsj0UwPOlehAPITpzjbJgX3iyOQYhk7mHh4STlafC:guKWgSJTwRf28j0/OghlTp3bGXS9Hh46
  • TLSH
    T1A4232A003BE8813BF2BE5F7899F22145867AF2637603D64D1CC451DB5A23FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2