Extracted

• • Target
    b2eb9db749d9c7b6f137e9b12da9e552493a1979e745ae1ae1b5954fbe120b40
  • Size 45KB
  • SHA256 b2eb9db749d9c7b6f137e9b12da9e552493a1979e745ae1ae1b5954fbe120b40
  • MD5 97ecfcd73a863d167918688e525d1f12
  • SHA1 f3734c4349a8cc877cf3de7844507dd44f00fa62
  • SHA512 aa13e6dcc27ec01f3d8ce82649f355df93a9a0d45aac52fb823cc615ff3cf1582b2b67ade69988bee55cf9ae82ffd30903a6359bec8d99f519b74d177744518b
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1E+GtnVnJtHuPIWzjbWgX3iPodMqXIuyIz+YBDZcx:RuxkJTgip2v++B3W3bJXSPuMEhz+edcx
  • TLSH
    T1682309003BE9813BF2BE4FB8A8F26145467EF2637603D64D2CC451975623BC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2