Extracted

• • Target
    2f790b43e2c43e352f888db94513083a8f835a9a4f0bd9e9b24ca9ec1dceba5a
  • Size 45KB
  • SHA256 2f790b43e2c43e352f888db94513083a8f835a9a4f0bd9e9b24ca9ec1dceba5a
  • MD5 effbae408b061908c176be93e1289922
  • SHA1 a204789612184c4ca5e4c829f6a8f7845ebb108a
  • SHA512 d1f90ec5c46d1bfd4a509244b388747d50df86c568a511e0b9af3072577e109803a5cf4545971b70e096ebf305b2d095416945487960055ade1a5d37f16e63b6
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYrZo3TMtPIQYjbvgX3iAHL0WZRx5ceTjINBDZ0x:8uuSpTgyf2tU3QQbYXSA4Wpp3IDd0x
  • TLSH
    T1D2231B003BE8C12BF2BE5F7499F26245867AF6637A03D58E1CC441DB1623BC59642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2