Extracted

• • Target
    6cbb20a5b09aaf796e99a23f2930d69ea1d3a08cf8c983154aa1cfda5b29eb78
  • Size 45KB
  • SHA256 6cbb20a5b09aaf796e99a23f2930d69ea1d3a08cf8c983154aa1cfda5b29eb78
  • MD5 4a193579649fa8044de8ee2e7de64d16
  • SHA1 20aec0dff61209f5893c90eed02e35ae63ef3cac
  • SHA512 38ca8b6d89c757c80a695f63352f1d0f2d64ef0a1c2a064b6575dee4ca84dec740e434fe4fc2c992ad2d4145e7d7e564582ade6ce025c4da2552912b5fd6c980
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4Mwz/y3qiPI9zjbMgX3iRPoBUIXyQBDZ0x:8uUIpT4vAj240h93bDXSRPohXNd0x
  • TLSH
    T1D9233B003BE9C12BF2BE1F789DF26145467AF6633A03D6891CC4119B5713BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2