Extracted

• • Target
    f6bce8f5283ef0cfe8df2dedc13cb09431dd63a3df2d3e15e64c39e3ab28c182
  • Size 45KB
  • SHA256 f6bce8f5283ef0cfe8df2dedc13cb09431dd63a3df2d3e15e64c39e3ab28c182
  • MD5 5659fb2aa904fa685201393480c80db3
  • SHA1 4dd4ab92885f97e9e7c36a43a44e689adc351ccd
  • SHA512 13671ad565f8658a1053551a146138a4f84188255f271ee5ea13f387a208ca9891fb6741ccb9685475dd40a46ec027f61e126d71456599412b52d4f9902c5af2
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAbgzZUpx7PI8djbagX3igmpTj/B5NucBDZcx:UuKWgSJTwRf2ron81bNXSg8TZdcx
  • TLSH
    T1F0231A003BE9823BF2BF4FB898F26145867AF6633603D54D5CC451DB5623BC68A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2