Extracted

• • Target
    2e7c6cd454c6314e3524024fd7bf35742744cd95b35a4235d663389c03f1346e
  • Size 45KB
  • SHA256 2e7c6cd454c6314e3524024fd7bf35742744cd95b35a4235d663389c03f1346e
  • MD5 7dc45e93a844d0f1670ddc5699257456
  • SHA1 5a173ec8cc2c68433aebc9d09e6757aec422f873
  • SHA512 b8011922f8a0c08fbb4fcbdb5c2b91903035a95e4c074620e11faf41611b50e2dc981a72f69021bb1d5566adcce66b0f10560e40413bfe6e226b24e1aa35728b
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdiYkk8PI4zjbTgX3i831OzimO+AMBDZG:MuBGJTPho2/LDmhB43bMXSs6imO1KdEx
  • TLSH
    T13A231A003BE98127F6BE4B78A9F26141867AF5732603D64D1CC451DB5623FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2