Extracted

• • Target
    2cc044bc30f2776df445c856b13d62e65a56b14491e8d953eff3332b9e2926eb
  • Size 45KB
  • SHA256 2cc044bc30f2776df445c856b13d62e65a56b14491e8d953eff3332b9e2926eb
  • MD5 c42816bcd3fc5a609e6eb53645739388
  • SHA1 2a2af4ddd98b88190845d7c750f18ddfa19b0744
  • SHA512 0a81df486952943f230cba7422822be5e26e2c3078a5e9aa760f3cc33f7fd81c17e8330db5b87a106a188eb3900fff96a26b069dfbf2db3099b341021707f246
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFP3Xo5EayPIQzjb5gX3iIjw1YTENh/70AN+BDZEx:MuLAZTnbg2YQEabQ3bWXSt1YwL/Q2QdG
  • TLSH
    T15F232B003BE8812BF2BE4F78ACF26245867EF5B36603D5492CC451D75713BC69A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2