Extracted

• • Target
    2ee2744138914a47e82fcae5bfdcdefcd76fa40013d152b2f0f1b5d97cf9538c
  • Size 45KB
  • SHA256 2ee2744138914a47e82fcae5bfdcdefcd76fa40013d152b2f0f1b5d97cf9538c
  • MD5 ead261dbfcc0bf7c830d4ad48ca42ec7
  • SHA1 3756d7f4e346a9da867697234e36b0d9b193901e
  • SHA512 813fc7e3abf68fef1439844a4bc235d9f731c8f3b9b94d07fa7efe138d31ec68a5c9e37c65d82d44e9c4b11f89f1f08bb4c7773cea2d94440df0770122bd99b0
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2QAm7PI1ejbvgX3i3yLFq8JdQBDZcx:UuKWgSJTwRf2GT1SbYXS3yRBdGdcx
  • TLSH
    T10A231A003BD9812BF2BE4FB859F26145867AF6732603DA492CC411DB5623FC5DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2