Extracted

• • Target
    2c7a2003b1a8b2c94f6eb5bcb3cd453c1dbf993ec1cccff67a28c04f4248b906
  • Size 45KB
  • SHA256 2c7a2003b1a8b2c94f6eb5bcb3cd453c1dbf993ec1cccff67a28c04f4248b906
  • MD5 f74a55aa92e8faaafa72afc5625a73d2
  • SHA1 c309a4ce26c1913cc10b6c6dc7057b1f3fb5f19b
  • SHA512 b631eaadc5853511c2e53cce9ede109efdaf5aaffa3dce7b082f8c57612aa68e8d5ba4c33ee7bf6810e86c329d65d2f3d39b083b8f41a6d47a4ddd344cbda731
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjbJg+3iD6Foafp9YWOV0LU91zeu:EufspTf2g2Oa9C3y3bG+StafS0LUehdu
  • TLSH
    T1D02318003BE8812BF2BF5F78A9F26145467AF2637603D64A1CC451DB5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2