Extracted

• • Target
    2e6310b0beac522a128e7603ee93c96fcaab7d372a8513be0fe8fe56291ccd03
  • Size 45KB
  • SHA256 2e6310b0beac522a128e7603ee93c96fcaab7d372a8513be0fe8fe56291ccd03
  • MD5 65022985bceef58b9c50db144ecef347
  • SHA1 351c163d24e8b72dbdd4e957d3a602e6a94fcc4b
  • SHA512 b031f5e3f040ebee3f8cc819a448d86d2b60aacf44187c51d0feeb248a76fc32b543a4a18ccaf8112407950bd1d6017efc0e909064588686e278040e8bf02638
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1P/qpG3jHuPIgzjbngXWiR0/qPgMRB0NlCBDZUx:cu6YepTPso2yIM3g3bgXfySIB8dUx
  • TLSH
    T1BC233A003BE8C22BF2BE5F78A9F26141467AF6637603D64D1CC441DB5613BC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2