Extracted

• • Target
    2e46b5cd7e2ce59af165c0aea0b9538c219de5b17cfd74f0193abba65b843b05
  • Size 45KB
  • SHA256 2e46b5cd7e2ce59af165c0aea0b9538c219de5b17cfd74f0193abba65b843b05
  • MD5 9b0e9606374eb52da585aa68d3760907
  • SHA1 43d57c6a7b8e7945b4ce2afefc6a9cd2661792c3
  • SHA512 ad4d0a076ef54ec96e8dfa5cfc02c949cd907076ade2db90b0293a8d13f4f41068fff517f4c2f726759e7501bdc37578ff3b71aec199ad3b4fb58e9bb1c94a9c
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwY7lt440WMOPI0szjbvgXOiR2dF8g9waDZeBDZMx:ku40ZTXEb24gUM30s3bYX38brZwdMx
  • TLSH
    T1F2232B003BE8C12BF2BE4F78A9F26145867AF6637603D54E1CC451DB4613BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2