Extracted

• • Target
    2c4c108408900d880ce618354762977f606737267beca230938a0395016f2a83
  • Size 45KB
  • SHA256 2c4c108408900d880ce618354762977f606737267beca230938a0395016f2a83
  • MD5 460bc6d7affcd814c3677ab737b820ee
  • SHA1 9249a530e4e3c03ba782714c8781cff34b1ed81b
  • SHA512 bb387f394a19d3776f26e6c68a2f3aee23e5a2ca06d0bdea08974d67410af1083cce829fb9d5d632c1ffb33315a87099134631e96235273f1c49228cc391b5de
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN9O5QyCBjHSNjPIwzjbngX3iFkpQ/HdXLBDZ0x:5uSy6pTpoo2MO59ESKw3bgXSuqdXdd0x
  • TLSH
    T1D3232A0037E8812BF2BE5F7498F26145867EF6633603E54A2CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2