Extracted

• • Target
    e2336a283db5c9c25c92f140b3dc61a38fa8c4e6e041f2ae254c3b1e60832649
  • Size 45KB
  • SHA256 e2336a283db5c9c25c92f140b3dc61a38fa8c4e6e041f2ae254c3b1e60832649
  • MD5 cf18325db17ee9a476ff807946f3e3c0
  • SHA1 cb6744f9c52bdb1b2f8af5345e90d0f68c1995ce
  • SHA512 3e980e6c327a7e1ae0728e851df91eca4ec359321b523e71c678138c76793a4d5663e4cd560ca652a0f1e1a95e8d0be01ff5fea432d8feac7ad980baafe229b6
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1yp7EcPIpzjbZgX3i7SRaY4eyUfw0BDZUx:cuR0JTPjY2+8V41Ehp3b2XS7ftLUYCdW
  • TLSH
    T1BF233B003BE9813BF2BE5F78ADF26145867AF6632603D64E1CC451DB5613FC286426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2