Extracted

• • Target
    2da85d68e2abb113b5b7fbd1b72d6690ba15883407279de2400608282b6693c4
  • Size 45KB
  • SHA256 2da85d68e2abb113b5b7fbd1b72d6690ba15883407279de2400608282b6693c4
  • MD5 fd2fa0179446dec4c542ae87006ff156
  • SHA1 0abe4127ce519672ccaa3203a3dd50718ffac7ca
  • SHA512 f47c223543b262e669bd697ac0aa1fddddc8740913ce76378dc3d6bf6c651b3fbf80b750e7647f274d05ce7044bdbd53ca09b7b696552ef5bd3edbd490c40bc5
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPIBzjbWgX3ieiAByYWF/BDZEx:MuLAZTnbg2O4Ea7B3bJXSzABBAJdEx
  • TLSH
    T1C4232B003BE8C26BF2BE4F7898F26145867AF5636603D54D1CC451DB5B13BC6CA42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2