Extracted

• • Target
    b2ea08ae8cb2cb6f3ed4a1df47254226ec065a4a38e96f804d20312c27b49830
  • Size 45KB
  • SHA256 b2ea08ae8cb2cb6f3ed4a1df47254226ec065a4a38e96f804d20312c27b49830
  • MD5 2f751f09d8841724b945fe51dc6760f0
  • SHA1 32e24700f161934d8547dbe2c16044a4d9e95bc1
  • SHA512 481b6f806425a40ae63dcbe4dc3c3ae807a1de7445e11afc315a8c70c1586c5ff95edd8b268ff7b4fba2cd9e7a1180a02ae07928e6ce37b7977c927e60f44431
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm/9GgrOPIRzjbIgX3idlytOxvPK44nteBDZEx:MuLAZTnbg2um1b3R3bfXSHv3K44twdEx
  • TLSH
    T146232C003BE8812BF2BE4F7899F26145867AF5B36603D54E1CC451DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2