Extracted

• • Target
    2db67c6c9f10adf8e7b9114e879cb066fc2c5e68ed95087b9645cfcea77be519
  • Size 45KB
  • SHA256 2db67c6c9f10adf8e7b9114e879cb066fc2c5e68ed95087b9645cfcea77be519
  • MD5 fa61d725303f2394179499dc402cde07
  • SHA1 8103222c085e08e11a599f4c69da74db60bf4125
  • SHA512 659c6735e2ccfaa8bb1aa0cf38893b3e9a73f7372ceba2a6090e514ff08b27496bdb4eddd8d2fb0040e88c693611138b3286f3d9e0a73ada7da1aaa2b30b7e03
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1wpt0CCM+d4CvS8PIkXjbegX3iXdI+9Yw/n0P6+sBDg:cuR0JTPjY2p/CFWBkzbhXSm4Yw0P6+q0
  • TLSH
    T1CD2329003BE8C12BF2BE4F7899F26245867AF6737603D6491CC441DB5623FC696426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2