Extracted

• • Target
    2c965acbfafb0b419d152de615801c6588f123cc0b606ef60edcbd5f1b58d37c
  • Size 45KB
  • SHA256 2c965acbfafb0b419d152de615801c6588f123cc0b606ef60edcbd5f1b58d37c
  • MD5 0090dfe9a48edb21a7fd43dd92275152
  • SHA1 022b7dc40ffc4b080140f49642c73fe63c5e6882
  • SHA512 56fa5da5fa52d4411f42c1d7eb313dcfc169352544b50e6a38f00014855333f5a3450fb93b00b6a590a35b32b5a16e8d50b3c77fddd5f41e239f34b17f8ee6da
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4DqTkafz+OPIEzjb9gXQizQJ/JeMkBDZ0x:8uUIpT4vAj2HqoR3E3bqXteJfSd0x
  • TLSH
    T12A233B0037E8812BF2BF5F78A9F26145867AF2633603D5491CC451975723FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2