Extracted

• • Target
    2c402942d8743427245cb14b3e6c624d03e073552e39301bd45aa7ebc08e29e9
  • Size 45KB
  • SHA256 2c402942d8743427245cb14b3e6c624d03e073552e39301bd45aa7ebc08e29e9
  • MD5 8102a3db00d0205169ecc28020860225
  • SHA1 3f9f58302fa6f71832ca7c567b70e8204a237aef
  • SHA512 45eae894a614f938523d005221501dd982c36b79457eeade4e0be683fce5e97b344b9545d4295a8b8f02df56a1d264174c8dee4ab8bfa3fe7c2523a76e8fd982
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q192q0CCMPd4CvS8PImqjb/gX3iO25M1BDZUx:cuR0JTPjY2kRCEWBmmbIXSO9dUx
  • TLSH
    T1FA230A003BE9812BF2BE4F785DF26245867AF5632603D64D1CC452DB5A13BC58A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2