Extracted

• • Target
    2f778d6a49efd0774ac377c5cef6212a1d8180e878e533a1da044a6a4043ec5c
  • Size 45KB
  • SHA256 2f778d6a49efd0774ac377c5cef6212a1d8180e878e533a1da044a6a4043ec5c
  • MD5 f9cefaf33d0463a9cd17ea7db4c5d88a
  • SHA1 381c1dab4c9ebb2e605739b932392dba39b781e9
  • SHA512 527449320e57e7a75fd161f11c66c3304043e508a9e16ae4abe46733f80b3284cddc179c07040216c8bfe5b4a26a81f5a2354082eda41412dcd43f3d0f79f568
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/rLzlJAOPIc6zjbWgX9ifclyHmSULMCu9BDZsx:EulCJTHl42ePp23c63bJXMfOySoFdsx
  • TLSH
    T14D231B0037E8813BF2BE4B78A9F26145867AF5673603E68D1CC4519B5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2