Extracted

• • Target
    cc0716bce201e71ff6105ca5f1362c7e9a8caaf094e6ab81aed3fbcb211cf5a5
  • Size 45KB
  • SHA256 cc0716bce201e71ff6105ca5f1362c7e9a8caaf094e6ab81aed3fbcb211cf5a5
  • MD5 61282ab19cfb23342b0b10c21c13c86f
  • SHA1 9fcbdb72b2fb93aaf69377409ffe8c58c2257f51
  • SHA512 819ab762ba38f3911d3fc2077468cf11155cf19c8ec5904a1b74567f6ff8fa0ebdc3ff1320dbd042c18cca997ee1d99ba6ffc6e5ea3513d7e40facbae06e457c
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQClsHoPEaMPI1OjbpgX3iPRhl37KJtJO2/BDZUx:cuqb5TrhG22uuEax1ibmXSPRz37otHJ0
  • TLSH
    T166230A003BE8C227F2BE5FB89CF26145467AF6632603D5891CC4519B5713FC6DA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2