Extracted

• • Target
    6ced6dad76ed6688bf2a91f7098e0a0f5453d648ddd852ce11de7394367f6e57
  • Size 45KB
  • SHA256 6ced6dad76ed6688bf2a91f7098e0a0f5453d648ddd852ce11de7394367f6e57
  • MD5 9e07d3616693dc88df4e300ab38e3ff6
  • SHA1 4db06d2b59725abdf9d2346b442d78f69f859538
  • SHA512 a9135e3301def4f77538f8ce6d75e3bf1422362a5577f405a544e42adb0b4a428427eb0b0438bbfac5697beb1a9836e444949bff6d62931fd8229a2fea07a588
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBjPSNjPI/zjb8gX3ikoI1xjWA2PXNBDZsx:EufspTf2g2hO5sMSK/3bTXSk3yrdsx
  • TLSH
    T1DF232A0037E8C12AF2BE4F789DF26145867AB6637603E64D2CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2