Extracted

• • Target
    2f584c496b84f3e191d489840f40b9dc698f3174867eb20df7b24a6796b70a6b
  • Size 45KB
  • SHA256 2f584c496b84f3e191d489840f40b9dc698f3174867eb20df7b24a6796b70a6b
  • MD5 6120ebd1711658c4746f0c5045f8ef85
  • SHA1 6e7ebeb6e4a13ce0e31757a176e78224ff84ef9c
  • SHA512 ef10e764bdb361b1b94648cfb8e22bb9f100c4dfbe903ffedc5fc43866494239a73aa944141979782ce750ab42c7f231f985a12e110a13184f4ea66e1b126ce0
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4Mwz/y3qiPIQzjbxgX3i+T0z6WKBSeLDSSNaBDZ0x:8uUIpT4vAj240hQ3b+XS+UXd0x
  • TLSH
    T1B2232B003BE9C127F2BF4F78ADF26145867AA6633603D58E1CC451DB5713BC58A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2