Extracted

• • Target
    a6409e1b658ded388e94ea68a0cc21849586a91f469a382882f811e9628a2624
  • Size 45KB
  • SHA256 a6409e1b658ded388e94ea68a0cc21849586a91f469a382882f811e9628a2624
  • MD5 e7a06ebb7f54df0a3b4a030321e7aeb7
  • SHA1 5d0c5651771406255c4c29551e40aba31fa7651d
  • SHA512 c6d1907b9420dfdabda3b639116c6fdbb1a6d664fb1e8eaba9e8a23842db61c29079abcb3a8b46395b104404681b3e4267516ad6f31929f05ba42753a1c67b73
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1kw0QbKXPIYzjbKgX3iB99FQ+0wgP2eqJoBDZcx:RuxkJTgip258Y3bdXSB9Q+0ZqUdcx
  • TLSH
    T10A231A003BE9823BF2BE4F7898F26145457AF6633603D64D6CC452DB5623BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2