Extracted

• • Target
    2b36141189c96418d4b1c32133c562287998fec9380dc446bbdcc5159b595e8e
  • Size 45KB
  • SHA256 2b36141189c96418d4b1c32133c562287998fec9380dc446bbdcc5159b595e8e
  • MD5 10db3bd02d917c4d3806dc36157429fb
  • SHA1 6c762431488cece89a0468b0c83fc8dad8de811a
  • SHA512 2b9976b38117f0a65d43d739652f329f432e9a61a2d6cdab943c517a9f41c74c5648ba4c32be00926c31c2a87d851b1be5aa8329511474ebd4d13f62027b352f
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFLSAFcKoabbb4ZhM/RPIAEzjbUgX3ieS4Dw2DBDZbx:4uLZZTUTn2gSAvQZh6OAE3b7XSetdFdV
  • TLSH
    T102232B003BE9812BF2BF4F7859F2614586BAF2633603D68A1CC4519B5713FC59A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2