Extracted

• • Target
    2a69bf564b404649162aa72fa0e3ab8ff7252b239ffbfb29e1635068f8077a44
  • Size 45KB
  • SHA256 2a69bf564b404649162aa72fa0e3ab8ff7252b239ffbfb29e1635068f8077a44
  • MD5 c3ffa25222b08ddda7fcc6a97003d3e9
  • SHA1 3e3347ec7da2df53f75eb9fb7450b1b7903f55f1
  • SHA512 b54665426a6dcc259d962cc71ab891a95b807ebd76ecfe293ea41aa0d161118110b12e4aa364b18e22e4688323859da4bfa48b1b99aa09a3b276cbd08c975e78
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1S8V1QpfEcPIYzjbngX3iPuT+BsOfWLA37OYHxBDZUx:cuR0JTPjY2J8ViBEhY3bgXSPuT+J7ZdW
  • TLSH
    T1F6233C103BE9822BF2BE4F785CF26145867AF6633603D6491CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2