Extracted

• • Target
    2aaf89a62beed4ae6dc6f096022bdc52f63bf8e01330d99db2fa32c76a84804c
  • Size 45KB
  • SHA256 2aaf89a62beed4ae6dc6f096022bdc52f63bf8e01330d99db2fa32c76a84804c
  • MD5 fc6c1f5373525c59e7b637d5d80b9bc9
  • SHA1 a303c30e5253939c44a90b2edc1ad265bd41695d
  • SHA512 250012446252d9358db85ae3938884453598be2efffb5a11bc968fae39f7c8e356f48c73cb6a862f55cdd3bebb09fe47718e4c0b861fdbe42488eb9967777f38
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4MIz/y3qiPIrzjb8gX3i2YIujF3ogBDZ0x:8uUIpT4vAj2YcRr3bTXS28pd0x
  • TLSH
    T17323290037E8C12BF2BE5F78ADF26145867AF6633603D6891CC4519B5613FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2