Extracted

• • Target
    2d4f340cbd4f87214d73a6a2a0c21037f1f7a93fe4fb3d3f8a8aea9691d93920
  • Size 45KB
  • SHA256 2d4f340cbd4f87214d73a6a2a0c21037f1f7a93fe4fb3d3f8a8aea9691d93920
  • MD5 980137a3d70641758eefd873cf6b1d91
  • SHA1 69fb1446b402dfbf9fed952a380f5f88af6bc8e6
  • SHA512 cc6a554ae398a07ab03c9e04f1b61697d76a28ad67c1985599e902c4b33a81f153a5795e9690de4ad2edd7dde07d061f5a2ef358832a62964e37ff287333f845
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q90ZbtDMQPI8JjbWgX3iJpiWvu2GgCBDZsx:EulCJTHl42lJk8pbJXSSWvu2Gbdsx
  • TLSH
    T122231C003BE8C12BF2BE5F7899F25145867AF5633A03D68D1CC4419B5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2