Extracted

• • Target
    2ebdbdf74118b82ac3ff7e21c4b0ec85f79de50e26e7307426b69001268e56ed
  • Size 45KB
  • SHA256 2ebdbdf74118b82ac3ff7e21c4b0ec85f79de50e26e7307426b69001268e56ed
  • MD5 5432fc35dee049907cd23d97bca7845b
  • SHA1 80e081a1ed02aeabf5c72e623b91c0932d96fa76
  • SHA512 58696bb869f6ec4553d09711a883ab30b828842f96971abc32bf190cb89ef78ff13fed3be410812dee6c1c1fee3d8dcfae945c1909ff0395c306d709942efd89
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA/+GtCVnJtHuPI+zjbggX3i/8snyop9Y3SjBDZcx:UuKWgSJTwRf2P+TB3+3bHXS/FJldcx
  • TLSH
    T10B233C003BE98127F2BE4F7898F26145867AF5632603D54D2CC452DB5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2