Extracted

• • Target
    2b4cbf20b989f8af6448fe43aa429d07886987da210e27a209e8c5dac8bf99e0
  • Size 45KB
  • SHA256 2b4cbf20b989f8af6448fe43aa429d07886987da210e27a209e8c5dac8bf99e0
  • MD5 4557c8d5709b8ed62709239763e65adf
  • SHA1 ffdb11b4dae7fb50f6826d89b44261d1030c4312
  • SHA512 add2d9baf18e9070156f91b9ff43e4de6377f98fad5a5745c3f08b4ae2f44cb1e1010f0ad6683d8017b617054284abc6ab2faf69e4dc75402b6a93da6c2093eb
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIvZjbygX3iwnZwI9gkKBDZUx:cu7e5TH2A2q4EaHvZb1XSmZjgVdUx
  • TLSH
    T199232B003BE8822BF2BE4F78ADF26145867AF5637603D5491CC411DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2