Extracted

• • Target
    6e54848d6c0290bbb3442016f4710cc7ef2d9adde4d6158c2c0fdfc3099fabf2
  • Size 45KB
  • SHA256 6e54848d6c0290bbb3442016f4710cc7ef2d9adde4d6158c2c0fdfc3099fabf2
  • MD5 db6cc03593cd9dafd96517f97c3a3d00
  • SHA1 417c85c79f36731d91968da7b70e66229085116e
  • SHA512 a88bad04d38d7594fc2f9161d531ca7f38960b8526f8d7320ac78f5a5e0da7cad05bf2003789717b6be8554f19725da00503cc7f4b3d945cd35ad81092d1e6c8
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA+VlcVl6GcPI+zjb5gX33SSeByPuIfdtBDZMx:kuSOpTPOP2OV2X6Gh+3bWXHSStuSdMx
  • TLSH
    T19F231A003BE9C22BF2BE4F7898F26145867EF6636603D5491CC451DB5713BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2