Extracted

• • Target
    f6b15c83b4862464645debab0c3f50d22f5ffca559a60e53a758455ea97531f1
  • Size 45KB
  • SHA256 f6b15c83b4862464645debab0c3f50d22f5ffca559a60e53a758455ea97531f1
  • MD5 5831c8aaf96114ccf47cbcc5cca92738
  • SHA1 b41ffaec9504a45be8fa9c339b45230b58f01ea9
  • SHA512 2dbc4af121778ed2064892b1f14307151685e7b46510d080c7df9d78a3458c5b9947675dda148e24342edcc3dfd16f471aa983bd265909d93db05f610aeaf0dd
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1RpPEcPIMzjbPgX3iZorvHgRVtEBDZEx:MuBGJTPho2t8VDZEhM3b4XS6r4RVtydG
  • TLSH
    T1DD232A0037E8823BF1BE4F78ACF26145867AF6672603D54A1CC4518B5613FC6DA52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2