Extracted

• • Target
    2740c5e4cf0b77a7d110b56ba657d5bf19ddd4e76ff4ce2b8601220d5e43c2e8
  • Size 45KB
  • SHA256 2740c5e4cf0b77a7d110b56ba657d5bf19ddd4e76ff4ce2b8601220d5e43c2e8
  • MD5 d6c94d4f69a4e99a1f80c9c64c7119d2
  • SHA1 afff77380373e1b0c9e1834295b83e51e9979b87
  • SHA512 6890fa619ed8f221de2507033fb5056b970ae040fd126d3952301dac046033a9e1147c6ac54fc15887e01ebd24419d9c8330dcd517ba37f1d6d052d517749f41
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAI0y3NPAIeiZPI2zjbGgd3iUo2K2ySXRYQBDZMx:kuSOpTPOP2e3V8iW23bZdSE1RZdMx
  • TLSH
    T14A232B003BE9812BF2BF4F7898F26245867AF6632603D5491CC451DB5623FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2