Extracted

• • Target
    6c5e8a31d89de9aa40716c2be607fb650abe1ae4e1601a9f9e4d74a2002eabb5
  • Size 45KB
  • SHA256 6c5e8a31d89de9aa40716c2be607fb650abe1ae4e1601a9f9e4d74a2002eabb5
  • MD5 42dd4e2b34a254fb30818eb839eb5ee2
  • SHA1 2d90f4c1b1187a956fddf7ddc97e963eeb5c545a
  • SHA512 544dedb8a9b4f518444d524fccd992dffba725568f3ea78f998192593aa343f02384a7eae1e9240d7b251a00c05333295364339ce8710b3e77cd798c3faba56a
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7SAFcKoabbb4ZhM/RPIAEzjbggX3ieAg4ch8dDfB9:cu7e5TH2A2QSAvQZh6OAE3bHXSTIaDQ0
  • TLSH
    T111231A003BE8C227F2BF4B78A9F26145867AF2632603D54E2CC451DB5713FC69A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2