Extracted

• • Target
    6506603e1fb213c96d3b3afadb0539de8dde95f3cf926a1ee25466f3b34964b2
  • Size 45KB
  • SHA256 6506603e1fb213c96d3b3afadb0539de8dde95f3cf926a1ee25466f3b34964b2
  • MD5 b23ea4f028847a5bca19a37a06b3f88c
  • SHA1 00b47d14066b1366506ff0592c367d671c83ca55
  • SHA512 d16b1059771744dcd6ab95d31a26fe0eb9d92ee3d339836c885d85c5c1f71a94fe799bb2b718bfc6009e0ac340728819b41d182db73624c2bed5d03156d3cbe8
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpYEcPIazjbSgX3i2/ohMlfSjk5BDZMx:kuSOpTPOP2W8VDeEha3bVXS0DSOdMx
  • TLSH
    T1AC232B0037E9823BF2BE4F7899F26145867AF6633603E5891CC451DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2