Extracted

• • Target
    2a139f174f1c1c447856d90896388f9a3421f703efcd68daa9ce7fecb54325f7
  • Size 45KB
  • SHA256 2a139f174f1c1c447856d90896388f9a3421f703efcd68daa9ce7fecb54325f7
  • MD5 028102c53de966ad6e7caba2cbf83488
  • SHA1 e2d11a4cc8c4d1ce40af25afe35f0e69c603bdbf
  • SHA512 d8dbe4ccbb4cba93436dcc460f24cd71eebbb7aad833f4926d7e376bb92a5bd709f935b5db7575bf372d8f2837d213288e3903883e1bd43dbac4807fbc9f6d16
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAcGju8eQlZwZPI5zjbwgXXi/ghLXFDTGq6nNBDZUx:cuqNJTLr62MGjuVGwW53b3Xy/ghhDTgQ
  • TLSH
    T17C233B0037E9812BF2BE4F7898F26245867AF6637603D5891CC441DB5723FC5DA42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2