Extracted

• • Target
    2bf3b691b239c98aad601bc21313374cfefc5d20349b55689da52e4de703f230
  • Size 45KB
  • SHA256 2bf3b691b239c98aad601bc21313374cfefc5d20349b55689da52e4de703f230
  • MD5 ffd4d3608bca458ec974de644fdd9ff5
  • SHA1 78e3c1ebbad893eccdf394b96ac66c3cb114162c
  • SHA512 f8468a766bf649af6a35d06cc2898c2891cfd1b4be48af235a92a8c5a0d325a46660ece18b57aa0c8033020b6115f8bed6c5f4cec662cfc04b645b304b756510
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFCzdAAyPMlL8TfPIMWzjbBgX3BIcLzQe9XF2w6pBDg:cu7e5TH2A2nlvlL+4MW3buXRIcL8P3dW
  • TLSH
    T124232C103BE8812BF2BF4F7869F26145867AF6632503D54A1CC452DB5623FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2