Extracted

• • Target
    c2ef1e370b9b69ef35b0141c6b1fefd3b04000d242c9eac49774056c91ad9ec1
  • Size 45KB
  • SHA256 c2ef1e370b9b69ef35b0141c6b1fefd3b04000d242c9eac49774056c91ad9ec1
  • MD5 f6a56fd079ac14e407397bd36fe4c1e3
  • SHA1 a84d4e9816e98f80e903adc767ad391ac55969e9
  • SHA512 371698af3f6f6ca66b0af4bc8fd5b2c900946cefd0f59ab370fc743d293563ddf4d53cb15e3fdf099cffdd3d2534f698ef22b434df70c216a8f2a4d37ecba766
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IBz3QKx7PIQwjb3gX3ipBQfNBDZUx:cu6YepTPso2NV0Q4bQXSpBgDdUx
  • TLSH
    T16D231B103BD8812BF2BE4BB899F26145867BF6637603D64D2CC451DB1623FC696026FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2