Extracted

• • Target
    2a9a6e97bd75c1a0a4e9b1f7ca3508ec9fab6a036452b385bd97516d15712686
  • Size 45KB
  • SHA256 2a9a6e97bd75c1a0a4e9b1f7ca3508ec9fab6a036452b385bd97516d15712686
  • MD5 3c18349182b92ef7983bb0f867fb1713
  • SHA1 5d3bb9f55b5e6272bb53ce3c432a22ce68b3138b
  • SHA512 c042976d2682586e74e9b5b348da0607efaeb37d530cdb4ebfc77f36e5318be17f9a81c91a279d76c532b9daeb93e40c30a508a25186d82cdb1574dde4a07d83
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVp8V1QpfEcPIYzjb8gX3io32PZMElSI1y2mBDZEx:MuBGJTPho2y8ViBEhY3bTXSrPZnmdEx
  • TLSH
    T15B232C003BE9823BF2BE4F7898F26145857BF6632603D6491CC442DB5613FC69692AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2