Extracted

• • Target
    2d9dbade772900fe361cb6d389da386c7b379f98279d7695fa1e6c3eee23f589
  • Size 45KB
  • SHA256 2d9dbade772900fe361cb6d389da386c7b379f98279d7695fa1e6c3eee23f589
  • MD5 6b3c21db5ead40ba21ef2fc62d3973e6
  • SHA1 2b8772d086d5d62524d2852c363850beb6ab4da9
  • SHA512 d3ee66fbaa2d748c2a4e21da63223b90494d644c195b3842a73c7a53bbdebeb4878d19f677dd3c80be066a5fa49e907766989b4fd2538d10fe5578ee2fa2b714
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1SVbIpeUGcPIOzjb0gX3wc2jglm17VB+BDZUx:cuR0JTPjY2rVs4UGhO3bbXgJE4BQdUx
  • TLSH
    T166233B003BE8813BF2BE4FB8ADF22145867AF6636603D54E1CC451DB5613FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2