Extracted

• • Target
    2ff6fadce8fde4c92be4c7b578c6a4f44f360b99531ff6b2bd835717e0cb1549
  • Size 45KB
  • SHA256 2ff6fadce8fde4c92be4c7b578c6a4f44f360b99531ff6b2bd835717e0cb1549
  • MD5 1e68b0b6bfa305ea3843085a19c7d205
  • SHA1 89e429f2b588825fe874f82de20808b9aceffac5
  • SHA512 0f0d8935db945a74b17cc8dbe8cf1cff507cb82f48f9bea4e34c5ad80e3f9a9a7e8baaf82bbaff8b4fa4fb3c767283a2767ac5cee9b9e75b2ab50e35c26f9c0f
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtth5BewwbOPIMQzjb2gX9iCOf1QhFIS9eaBDZ0x:5udApTNmU2y9F23MQ3bpXMbMISRd0x
  • TLSH
    T1AB233C003BE9822BF2BE4F7898F26145867AF6677603D58E1CC4419B5613FC6C642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2