Extracted

• • Target
    2b41671bee0adb6bd27ad5fec6f1d40c8815704f9898b0f6a652ae39b425d46d
  • Size 45KB
  • SHA256 2b41671bee0adb6bd27ad5fec6f1d40c8815704f9898b0f6a652ae39b425d46d
  • MD5 67b2fb05084359db2a02d48bac6feb9c
  • SHA1 2f8c6ead33a39e5bdba92d3e3e71b0c9c0e74313
  • SHA512 feeb56d81fcd83d550cc34949fca346e552692d94217af853b70187a0aae4d1eefcbe31317701a4b73a1aef6dbbff60a3f1c2dc38436cf46b64d48bdb2631410
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ORzMwnOPIZzjbQgX3i2HHA5kQEbuHFgv51BDZsx:EulCJTHl42PA+3Z3bXXS2HHAeuHF+dsx
  • TLSH
    T1C0230A0037E8822BF2BE4F7899F26145867AF6673603E58A1CC451D75713FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2