Extracted

• • Target
    2276f920419cb1726823a684a3fe91b55690e1d9ae6f569a76d4d8071b01ebb3
  • Size 45KB
  • SHA256 2276f920419cb1726823a684a3fe91b55690e1d9ae6f569a76d4d8071b01ebb3
  • MD5 aaa78217fa7747a6e2c572b2535caebd
  • SHA1 ec208d3c959cf2e4bc017bb3631f804859b76c1f
  • SHA512 6cb391ddfdcd62388b24319a662cfcead061631f1e7ec98b4ae90f1caf8cbf837b8b5d3f13085ca11a3806d6f36a3f3db1b3610199134fc2a0e6b014ecf6d518
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4D9YSkqXzNOPISzjblXga3ifgZwU2D2NUNzyKBDZ2:8uUIpT4vAj23aVq3S3b2aSfgeU2Djz9U
  • TLSH
    T13C232A003BE9C12BF2BE4F7898F26141467AF6633603D64A1CC452DB5723BC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2