Extracted

• • Target
    2e445f1b072ff3a75d31dcda83eab2a55900b50d8d5b1440230e017cf911c976
  • Size 45KB
  • SHA256 2e445f1b072ff3a75d31dcda83eab2a55900b50d8d5b1440230e017cf911c976
  • MD5 2e2b2b399e4caa10948716de528f065b
  • SHA1 5b7da33c6990ae59ae7afa01e3614d5f919c4031
  • SHA512 94ea8c033ce8cb3fca637d2304fac9080724c0ccdf390d7ed1f78ce867fc0847f8d02d019fc2b841ccbdf1ba51d0f556f0b1408123b9cb182cd3070be84af054
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt5t+xFNbwOPIMMzjb/gX35AbZg519FX+X7PLHBDZ0x:5udApTNmU2WIXc3MM3bIXJGe51HOX7P6
  • TLSH
    T16D231A0037E9C22BF2BE4F7898F25146867AF6633603E6491CC451D75613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2