Extracted

• • Target
    2d31e08793add140a1c6ad05761701be4026d4524ca7b0d44b632219f83616c7
  • Size 45KB
  • SHA256 2d31e08793add140a1c6ad05761701be4026d4524ca7b0d44b632219f83616c7
  • MD5 00e017660190b35d14a9eafda62b05ce
  • SHA1 a152d99e3cc54072da01060fe771bf5f3cb202b0
  • SHA512 4c3be57d46fa834a0f7d748a58b55241f1635d8a44b016cb452cd797c36ff02462ceb9ae0de7845e9cfa6aff72d37d07b3583f0b8ef91254b50a3a8b1a75973f
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvmjb3gX3iJNtnUmY3KvKUO9TBDZMx:ku40ZTXEb2C4EaHvKbQXSlUmY3KvKUOY
  • TLSH
    T17E233B003BE8816BF2BE4F78ACF26145867AF6633603D58D1CC451D75613BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2