Extracted

• • Target
    2e5936782c52989aaca027bfdbc4a01ad9bfecd682af9473f58934e98ab8ba93
  • Size 45KB
  • SHA256 2e5936782c52989aaca027bfdbc4a01ad9bfecd682af9473f58934e98ab8ba93
  • MD5 ea281f0a60c270ec57f48b684f9eb7be
  • SHA1 8e789bc864da7a4a31c0d88724e2ca1241d5d9d0
  • SHA512 58aa468939a99ca5f5aefb64407b8659ed8113f31d4da7596f231dff9d5004780a623467ef84c0d091f0899e00b8fa34e8fdd50c52189b7613323b3052e0b689
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HmaPylF3APIFzjbqgX3idGdjx8AciRD4BDZUx:cu6YepTPso2Wfyv3lF3b9XSQf8AjJ+dW
  • TLSH
    T1C123290037E8C13BF2BE4F78A9F26145867AF2637603D65A1CC451DB5623FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2