Extracted

• • Target
    6015f995c04828d08fb2655f6e8a9969585934a801c36c3ffbe8f97c113be65f
  • Size 45KB
  • SHA256 6015f995c04828d08fb2655f6e8a9969585934a801c36c3ffbe8f97c113be65f
  • MD5 6c74e4308a1a11668d6d72bedeb1c18f
  • SHA1 64f9c359049fea252e2556b86c0174aa7a057d64
  • SHA512 a632571c844609e0d7642bb5e97766259fea5a6ece87460196b982488218035ce0772bb1561c1d9b1e01f18131074901ad70f8dfb6abadb21c0e401d74128359
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlVl9fcBEahPItFjbigX3iftU+39UBDZMx:wuDWZTpMZSB2cLkEa+tNbFXS93wdMx
  • TLSH
    T182231B003BE8816BF2BE4F7899F26105467AF2B32603D58D1CC455975613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2