Extracted

• • Target
    2bccedf7cd76f3a70d0fde11a3a27dbc7d95760bef02c8284e5e817036c8dfeb
  • Size 45KB
  • SHA256 2bccedf7cd76f3a70d0fde11a3a27dbc7d95760bef02c8284e5e817036c8dfeb
  • MD5 f6a777145cf1ebc0a94a4970620d183c
  • SHA1 36725fef0032d12e907e85d2388073af50517d83
  • SHA512 f99476aa3d2cd8fc68e24f37fda0545d11af04e322fc72966e0c5cf1060e0d8397da6d2155a71517b355cc574589f3572ffaebd144c44bf17f47fd90e553333d
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlyBlte40WMOPI0Izjb9gXWibUBEOtGChO+eqABDo:wuDWZTpMZSB212UM30I3bqXfQBE7YO+d
  • TLSH
    T145233A003BE8812BF2BE5FB899F26145867AF2733603D64A1CC451DB5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2