Extracted

• • Target
    2e94675ef1b61ef4f83c2ab1a61f47e3c6a55e5d9244ffd099c8d6ae2c98702a
  • Size 45KB
  • SHA256 2e94675ef1b61ef4f83c2ab1a61f47e3c6a55e5d9244ffd099c8d6ae2c98702a
  • MD5 39c9a3c454f0a6afd242bfb4fa37480f
  • SHA1 0b39ebf624874c22a0e3b315d11ee5104ed81660
  • SHA512 c523a18397e8e61afe737d5931b8c59b782c88b7dd6cfb5d6703bdc65036f30170d981c4e0fa9209eb9a28dd8fed161c3e7e4a9c3f2d9e8ec4a3a74a7dde4726
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4Mwz/y3qiPIDzjbCgX3ieiq/9UmPz4sBDZ0x:8uUIpT4vAj240hD3blXSE+mP/d0x
  • TLSH
    T1B3233B003BE9C12BF2BF4F7899F22145467AB5632A03D58D1CC452DB5723BC6DA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2