Extracted

• • Target
    2667d2184973fda22793c77f024c41b2e2c8c8e1ab18e8d7df5a78e7cf0e8166
  • Size 45KB
  • SHA256 2667d2184973fda22793c77f024c41b2e2c8c8e1ab18e8d7df5a78e7cf0e8166
  • MD5 121e75023a43dde1e53c6dcc0d30a799
  • SHA1 d366b3228f039cbc29d23251c85c98139a785b87
  • SHA512 bbfa9d4bf508b2c605ee2a03e0f60075871b8a0abde89a0d3af02c910f7917643acd45da722e12e951a274b61377fd0d5c1d6a97b96e9043ed482728e75e0169
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qww3vO4iZMOPI0/zjb3gc3inGwGu1bt4G695gBDZMx:ku40ZTXEb2EmNM30/3bQcSnGwnptL69/
  • TLSH
    T12C232A003BE8812BF2BE8F789DF26145867AF6636603D54E1CC451DB4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2