Extracted

• • Target
    2bbe8db0a31bb3fd59b8c8174ba54508d2e13873eaea3664aec914fdc1df5658
  • Size 45KB
  • SHA256 2bbe8db0a31bb3fd59b8c8174ba54508d2e13873eaea3664aec914fdc1df5658
  • MD5 a1ce5c193ff8219d9da1388053a583e0
  • SHA1 ff8d245423a6cc0541b19117c7372c5e0d231c3f
  • SHA512 a78ec2203396ca3dcd88e999e2a7e9db86784664bb253239d1cbec7b1845caaa8c330206934dc3774cacd87e1925d2a141de2c480a1628343786ff9d6c0c1001
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT2Qpm7PIhyjbxgX3iYN16LxBDZUx:cu6YepTPso2Neheb+XSnLPdUx
  • TLSH
    T1BC232B003BD88137F2BE4FB898F26145867AF6637603DA4D2CC451D75623FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2