Extracted

• • Target
    2e997cacce8de592046e61e108c2892aa133d3a0be838ce242405a193137f1f4
  • Size 45KB
  • SHA256 2e997cacce8de592046e61e108c2892aa133d3a0be838ce242405a193137f1f4
  • MD5 ece4a61c87d9e9e0ca5fa4a7acc0b601
  • SHA1 82aa909551dbb3023812d9c6221bea1042011a1b
  • SHA512 5961ba6ccc9738a1a3999759e9ee3b1a75ba7aef8403dea52a93ed24030a18e365a330c669e0a55f82ac4efba8a8aaad3df38f372a97122f660701ca741b9b7d
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1yp7EcPIpzjbigX3iDu7XSXN3lLhqK2hNBDZMx:kuSOpTPOP2W8V41Ehp3bFXSYAN35hEV8
  • TLSH
    T1ED233B003BE8C23BF2BE5F7899F26145867AF2672603D54A1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2