Extracted

• • Target
    b6922ffce26fd203754d60ceb7e2697384dd4727331cd1e9dff2ccf687bbcc27
  • Size 45KB
  • SHA256 b6922ffce26fd203754d60ceb7e2697384dd4727331cd1e9dff2ccf687bbcc27
  • MD5 e24375a5efb969af0b4b72dbb9e4d3f2
  • SHA1 4bda643618f7c8df65fd811176e968a96d3aaa5c
  • SHA512 5437a304d072c6278a42fc0fa9c2de9cf2d8d0c7931e3085933a00965f900fff0b3eeff3e2f4a68761930e3a440911ae7c38ee26781efe067e6f71ce0dc8e23b
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtrELL0YjSOPICLzjbLgX3iULXc1wBDZ0x:5udApTNmU2LbG3CL3b0XSScod0x
  • TLSH
    T126230B003BE8822BF27E4F74A8F26145867AF6633603D55A1CC451DB5723FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2