Extracted

• • Target
    6c2cb5eb67c90bfa459cc93fbd0bdca487907b56b9bcff0ad70704a4810e006d
  • Size 45KB
  • SHA256 6c2cb5eb67c90bfa459cc93fbd0bdca487907b56b9bcff0ad70704a4810e006d
  • MD5 94d353af9abc90c09189bab095d5eefa
  • SHA1 78e8f97bdcfd4cd33dc8d84e154c04d1beffa73a
  • SHA512 552857d6156b796e8106db20d74390a8751b1b2825aa45ceaf1694b8b083f78c1417b877a64e8ee678433d4d1b4c50b28c887b272993dad2625133132bbd7b56
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1GxJaxrPHuPIHzjbMgJ3i3eLWGcOOBDZcx:RuxkJTgip2zeR3H3bDJSa8dcx
  • TLSH
    T1F1231B103BE8822BF2BE4F74A8F26145467AF2637603D5492CC452DB5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2