Extracted

• • Target
    2cdbeb8d06f889dc974c7b7ba635a5ee7933f3a61c4dbf3250631782707f2a68
  • Size 45KB
  • SHA256 2cdbeb8d06f889dc974c7b7ba635a5ee7933f3a61c4dbf3250631782707f2a68
  • MD5 c9e5c1c7ebd0ea4adf14306b5f932630
  • SHA1 0f06b69711c5a1d52a659f19dfd1d94c42446a16
  • SHA512 a8cdcfbe727a059e0d17bedf04e0830cbe5e11ced2356c52d389df2ce4640603bdd1ec054a03de394ccfa8999df53163584680ad295a8e8c224b5af0a57f61ff
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXK5oibbb6TN8/nPI6WzjbBgX3in/AIgAUBBDZW:cu7e5TH2A27eEqTNKA6W3buXSn/AP/dW
  • TLSH
    T1BB231A003BE8C12BF2BF4F78A9F26245867AF2633603D54A1CC451D75713BC69652AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2