Extracted

• • Target
    2cf3087348ab4fff0812f819c124fd9fbd7ff97649f6532cd639a00bb76d1410
  • Size 45KB
  • SHA256 2cf3087348ab4fff0812f819c124fd9fbd7ff97649f6532cd639a00bb76d1410
  • MD5 4ef8e6b2a9cedfd416d88c5923717b74
  • SHA1 f50fe37d3007973d9e15bfd9bc6532ba6e332198
  • SHA512 73243830471dc11d61e1f36a17889ce0f260fa2dd85a56125d39629c636f299b6b5ea7c7d3f270d6a34426c41151278bb8d973bcf971a5f6191d89eb71c143b6
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4b9wa0y/zFOPIuzjbbgW3i4mrNkHWW2moBDZ0x:8uUIpT4vAj2fCdi3u3bkWS4wNKYBd0x
  • TLSH
    T11E231A003BE9C12BF2BE4F7899F26141867AF6633603D64A1CC452D75723BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2