Extracted

• • Target
    2829e052e523ecc738aab184fd163007a8e921ee5b371b4c8bfe80d996e0cfbc
  • Size 45KB
  • SHA256 2829e052e523ecc738aab184fd163007a8e921ee5b371b4c8bfe80d996e0cfbc
  • MD5 8d65049b7d47491bf576eabd657e9d14
  • SHA1 63fbcde923cf0e5b071fecfc305729188f9b2ae5
  • SHA512 532827eceb54330b51adf6d14908894d095ed5e43954620823584ef67b4465bfc0af0fed3337caf7b97b5c2856cc8bf4e76c323d050e64033161e4cc69807d57
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9O9+N6KbtOPIMtzjbPgX3hmP+lcICwE5GgfBDZsx:EulCJTHl42xkDZ3Mt3b4XxmNFdsx
  • TLSH
    T11B230A103BE8C22BF2BE4F78A9F26145467AF6633603D64A1CC451DB5613FC58A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2