Extracted

• • Target
    6514de18ec32a3bd287e31944a1ddf652be13afdc2f98eaba4563c3553b578c3
  • Size 45KB
  • SHA256 6514de18ec32a3bd287e31944a1ddf652be13afdc2f98eaba4563c3553b578c3
  • MD5 6e0c4d980216d4374f437b8ec276d3a1
  • SHA1 7d86c7c1a226a591ee011c3f6d5db1af3dedd714
  • SHA512 d8b90444a4ea6036356a67f78e4b458782f3d0652c728df52915a31ef2f7711fe713b8d77623fb2fc8589742208376f21dc1384b2f7402fbedc1d64e8a523895
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UzjHy/aKPIbljb+gX3iWdBQ/X/vGkI8cDhBDZ0x:8uUIpT4vAj2wnhbtbBXSWdBQ/X/vKPDM
  • TLSH
    T1EE233B003BE8C12BF2BE4F7899F26145867AF6633A03D58D1CC4119B5713BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2