Extracted

• • Target
    2c17ccaf1eb8c0d157a9854779c20a342ccfb8b717b5f21b23139bb97abc1ebb
  • Size 45KB
  • SHA256 2c17ccaf1eb8c0d157a9854779c20a342ccfb8b717b5f21b23139bb97abc1ebb
  • MD5 804d1b55e477bce929c42f7ed2c2035e
  • SHA1 4f279ade46d905632752c12ad67c866d2b3f8f6d
  • SHA512 0cf6ee92fa24e7ebdb0a9716178aa9ea98e4087024755375b244d71a17809c5feb19ad123d1ca5712be532abbe7610d03f1c186bb2ab176f51a5cebe41aa4815
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkq/zNOPIFzjbTgS3iKULWk+e0k/NFcRBDZsx:EufspTf2g2maVC3F3bMSSK99vdsx
  • TLSH
    T17F232A0037E8C12BF2BE4F7899F26146467AB6633603D6491CC452DB5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2