Extracted

• • Target
    2cb23eafc5fb516f1557df43f8f4049fa1b2ff1502b33aff96306c80fe269037
  • Size 45KB
  • SHA256 2cb23eafc5fb516f1557df43f8f4049fa1b2ff1502b33aff96306c80fe269037
  • MD5 00c1c434e1cbc9b77c12de21929d1624
  • SHA1 c2f1128c72ec7fff8259f0450bba863e5270e0d0
  • SHA512 cafe3e261077a29ae0dc57d91b1ea165140d0babada54349ff8259d347865f5c8dd78edfcfb1ae8f09c28d21c9ca05937048942fac7fe8037bddd9bdcd2a2482
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwOseXusMkFX8vnPIMvzjb7gX3HwaJ3jPe2Wn79uRHu:ku40ZTXEb2NeB1FXiAMv3bEXXHzWvIj8
  • TLSH
    T19F232A003BE8822BF2BF4B7899F26145867AF2637603D54E1CC451DB5723BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2