Extracted

• • Target
    2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c
  • Size 45KB
  • SHA256 2e1461f42b4c004bd67cdd6988f1191ad988131e123bd7c12b5cb0ff1baa3b5c
  • MD5 c2140b46bc94dc7cc7bf57c845ceba8f
  • SHA1 90a940008ac0707137d401616b40cb6e60f44eb3
  • SHA512 b379a55701de5e1e2467c07997785b1ce48c7302dbde7f9eed523d9a3b88d7bfdac99a5611e75a10981551823d0b9b992783bae43a06c67bc9c7d1d0a19b70f7
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QyCBjHSNjPIwzjb/gX3i632UA2N6ibh1BDZsx:EufspTf2g2hO59ESKw3bIXS6O2lddsx
  • TLSH
    T178232A0037E9C12BF2BE4F7898F26145867AF6632603E54A2CC451DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2