Extracted

• • Target
    2ed1be1e5aab9f8c8f315bad47eb1dc4b9c83ba2619ea42e070d4f6285dc05ae
  • Size 45KB
  • SHA256 2ed1be1e5aab9f8c8f315bad47eb1dc4b9c83ba2619ea42e070d4f6285dc05ae
  • MD5 cf691a141d3cd4925a7f82f32fe7a2e1
  • SHA1 28998f8e904a8ec92cb7461ab55a3a61c3d3a78e
  • SHA512 261662c9ff4d44f2eab16e2a1162528b8351913931ccdecfa4e90595930f26b3e17e7026f2d202e6c7349c74190eacdac70906ed1349767211cc6df91e8a0d01
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEaEPIQcjbLgX3iRYIGKNXhPnz3uBx+ABDZMx:ku40ZTXEb2C4EapQsb0XSkKDzOdMx
  • TLSH
    T14F232B003BE8822BF2BE4F789DF26145867AF2736603D5891C8451DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2