Extracted

• • Target
    2cb1e0049a06680d4c374deb24d481305ed54ce18415ee0e9b881b40147181ef
  • Size 45KB
  • SHA256 2cb1e0049a06680d4c374deb24d481305ed54ce18415ee0e9b881b40147181ef
  • MD5 17ee5059f76ccfb1b2483adf2fa8620d
  • SHA1 52acedfeba99d2139a2884f50526ed2a140894aa
  • SHA512 256ad040861bcb6c42525fec4e1b2989dfd8d114fabe9f327010874ba7f173074b906316d411e16fa94ce8a4bc1630098f777162038da26c921660e59e754005
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q17bqYGYjHuPIAzjbEgXtiFk9RPjVqr3nRBDZUx:cu6YepTPso22d/3A3bLXcq9RPj0nvdUx
  • TLSH
    T19A233A003BE8812BF2BE5FB89CF26145867AF6637603D6491CC451DB4623BC696436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2