Extracted

• • Target
    6f9c8265b04340dd781121ac6c59cba747c58e4495aa4ec226d36f00612f4216
  • Size 45KB
  • SHA256 6f9c8265b04340dd781121ac6c59cba747c58e4495aa4ec226d36f00612f4216
  • MD5 6491151929b15192b3579c797a88e1b1
  • SHA1 89e31277614fd1ffa2be12a049aadc4cb2c3c8b4
  • SHA512 98bee92cfe79c5158619e55a1755f5356c121c58b8e04cc28533b5dcdb41b1c267ede82eadcfacc2fab90cf645605fd305a24c2219150131c41e3f8ae4753a82
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrYxJaxMwHuPIvzjbxgA3ilMeHVtRhenqrBDZkx:vuogpT7I62zeN3v3b+ASp1t339dkx
  • TLSH
    T15B231B003BE9812BF2BE4FB498F26145867AF6637603D58D2CC451DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2