Extracted

• • Target
    2dfe87bd8736167b88c334c667d74e9cabb4127c6709b21ead63f7c49e670b37
  • Size 45KB
  • SHA256 2dfe87bd8736167b88c334c667d74e9cabb4127c6709b21ead63f7c49e670b37
  • MD5 e11033d70d8364333480dc33e7650a3f
  • SHA1 c98186b23f16eb9f1d044750055428cdfb82727b
  • SHA512 c42e90edf5a059c61ffdb3c469a8d8b4c7e03de1ed5e4181aa2c22d2aa694fb80553c9ad1082eb56880536e1d6826f4f184b861391a63683161281c7efb471e0
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfPLzizpvtLjZPI9zjbSgXpi1eKbf48wdU6BDZUx:cuR0JTPjY2OfHi1VjW93bVXY1eKCdUk0
  • TLSH
    T102231B003BE8812BF2BE4F78A9F26145867AF6733603D5491CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2