Extracted

• • Target
    2d4b432604e0022d13f07fe876ee6ef269fa8ae0b000f92f39e1cc92e9b73525
  • Size 45KB
  • SHA256 2d4b432604e0022d13f07fe876ee6ef269fa8ae0b000f92f39e1cc92e9b73525
  • MD5 ff54c07956835ca79aa3149d6437610b
  • SHA1 8df0b69b080e8a680f97e59da839a1020f66e8c4
  • SHA512 aeac7d2c67524328c945ded9b5a86095a6620161ec4f08a9afb9c0d5672d638ab72d3fa9f892326dcbc468d8567576aa9b6bb32b5b763bff2c6ac4c46cbb63ab
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HmaPclm3API7zjbxgX3i3ymzSeXzBDZUx:cu6YepTPso2WfcE3l73b+XS3/mQdUx
  • TLSH
    T15223190037E8813BF2BE4FB8A9F26145867EF6637603D6491CC452DB4623BC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2