Extracted

• • Target
    2f00d744788abb593f006ed0a3ffcdf8f76dcd7f9b41a7af7cf81c0b65671c5e
  • Size 45KB
  • SHA256 2f00d744788abb593f006ed0a3ffcdf8f76dcd7f9b41a7af7cf81c0b65671c5e
  • MD5 8dfcba92284d40a25ddfc147e4575b83
  • SHA1 5a5934b1ae3372f27c1eb207ba18aeb3f29ebb9f
  • SHA512 4c7f3422aa1628953f052345fa91fc540bd83101fe6efa7a51ea2278f2cd1987a25999bcc4e6fe479ae21d51761afd670176083a0476a0095ff79ec020a38aa9
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1O8V1xp21GcPIozjbUgX3ihQ7JbMyN73u10zHmRBDZW:cuR0JTPjY2l8VzA1Gho3b7XShGJIy586
  • TLSH
    T112232B003BE8823BF2BE4F7868F26145867AB6633603D64A1CC451D75713FC6D652AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2