Extracted

• • Target
    2d4284f0cfa039763d88174a90cd89445706e04a87d2dd77463d9d3c72e933f2
  • Size 45KB
  • SHA256 2d4284f0cfa039763d88174a90cd89445706e04a87d2dd77463d9d3c72e933f2
  • MD5 9a627ff14b1daf08fd6f3e8e65482886
  • SHA1 2e108b7899623542c7d08aa6a44336fb5ff8f434
  • SHA512 a185f03590478947a8812c3eacc71f2a3e6b85ec57d95e0ce9da47a6c098b56f5b40f9e51a73f4701c22f2fbe553c887ce6586be3cbef61b0b035d6e0302a41b
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9ywzBNMwpGPIMPzjbdgX3HhqIYgWBnjBDZ8x:0u1YJTHcw2tWGYvMP3bKXXvYVld8x
  • TLSH
    T157232B0037E8822BF2BE4F78A9F26141867AF6673A03D54E1CC451D75B13FC696426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2