Extracted

• • Target
    2d0f72d215a05e387112a195c7c28c9f98197d2e9ca4f5a85cc51b8949811cef
  • Size 45KB
  • SHA256 2d0f72d215a05e387112a195c7c28c9f98197d2e9ca4f5a85cc51b8949811cef
  • MD5 6c9f5f2fcc9c319392f90960aaf7aacf
  • SHA1 ef8030bc5e51808fa1c4f43ea684284a16eb0197
  • SHA512 109a2e39b3a14f010d179bb1ad6a6009a2fb44ee27f4dcc840d000dfc947985f5a8b07c8f7a0f4ff874dbd8cf753ef6837b1b053d9931173f311954c3915c090
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qACLiE02FjMdjYkkmPIAzjbmgX3igbRNovyiVBDZUx:cuqNJTLr62yL9wQPA3b5XSgF2jdUx
  • TLSH
    T198232A0037E9812BF2BE4B7869F26245867AF5637603D54A1CC441DB5723FC68A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2