Extracted

• • Target
    2e49cc633eec3d99df6af818cddf29c571ae419170859263a0ef483208b608a1
  • Size 45KB
  • SHA256 2e49cc633eec3d99df6af818cddf29c571ae419170859263a0ef483208b608a1
  • MD5 11bd3018076a56f540056f11b933dfc5
  • SHA1 6b444648abdaa482f0d8907f4648e872f53d5c9c
  • SHA512 92e36303548c9cc03b3027d23376adae8a79e1989f5446acf2652535e56f393ff727138405756b3189d5ae38c62988c526d5d23a52f5fea845abade7ea92cd9a
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfkLyuObvtkjZPIuzjbYgXtige1VjqF9G9Wb1FcWh2:cuR0JTPjY2OfLuyyjWu3bPXchm9Go7dM
  • TLSH
    T15E233C003BE9812BF2BE4F78A9F22245867BF2776603D54A1CC451DB5613FC6CA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2