Extracted

• • Target
    2874916865262faa6089d51d8ed4ba5140b0645e2a66f141a4808263ce044b44
  • Size 45KB
  • SHA256 2874916865262faa6089d51d8ed4ba5140b0645e2a66f141a4808263ce044b44
  • MD5 1c6de03488db9bb0979d5f7d4cddd4d5
  • SHA1 af7a3a5bdbf44b4705440288e22306268a7e6555
  • SHA512 4ffa55d48483f4948f7b86269b3b9fb81762dd3fff2ad20ae1aeedaa2622e5666eedbe87e7ff51894cc2a5df9f8c52af84522f5f31cbe107d00abf025c28b7e6
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYCDEU66ZjlOPICBzjbcgX3if3TxPgfEDOkOjBDZ0x:8uuSpTgyf2qCsh3CB3bzXSfDafE2d0x
  • TLSH
    T1E82309003BE8812BF2BE4F7899F26145467AF6633603D58E1CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2