Extracted

• • Target
    6df00894b83d04253b59eb2fdb6b8b5979207f4bbb9f9a3ce2c94b96d968caa2
  • Size 45KB
  • SHA256 6df00894b83d04253b59eb2fdb6b8b5979207f4bbb9f9a3ce2c94b96d968caa2
  • MD5 bb9614717e7ef9b35ed4ae3fad89930c
  • SHA1 c40060b8b9edf590c7ff26dfb170dad71bbe6b91
  • SHA512 c563bfe8737e9ed2ed6755276bbf46b8f44b9494e08142cb5e8636834fc2566e906386f3765b97dcbd94807b1fccb62f87450421b11cf979592525f696f93ad0
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9z9Yq3qvhOPI9zjbAgX3i5EX5FZxxcWF2E9BDZsx:EufspTf2g2+aCC393bnXSydHv2ETdsx
  • TLSH
    T17D232A0037E9C12BF2BE5F78ADF26145467AF6633603D64A1CC4529B1723BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2