Extracted

• • Target
    2934e232627bae0f8dbae19826fb139c5dfabf8f4735e727c0bce21ec53ac4ab
  • Size 45KB
  • SHA256 2934e232627bae0f8dbae19826fb139c5dfabf8f4735e727c0bce21ec53ac4ab
  • MD5 d902e0cc22b45eb76c69cba6fcbde4b1
  • SHA1 2f28b4676023acb2bda57bf3452c04ae89b0638d
  • SHA512 886fe67f745af3178d0b16410b584e3d64d90f9b88229fa2e9e82a10c67cdc2fd50cb80c533d5da48281ba600fc5ee1e4cb51a0b34ba26ddad50d62d876de54c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHynaKPIs+jbJgX3iPLTH1UwmYBDZsx:EufspTf2g23nZsybGXST5hmedsx
  • TLSH
    T193233C0037E9C12BF2BE4F789DF26145857AF6633A03D54A1CC4129B5723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2