Extracted

• • Target
    6a860027f444fdfe6e22f7467a7d65edfa6ce1ffa4f73f00510b9d51cd2973d4
  • Size 45KB
  • SHA256 6a860027f444fdfe6e22f7467a7d65edfa6ce1ffa4f73f00510b9d51cd2973d4
  • MD5 62187346ef4a964ef662d9ed0ab6b1b9
  • SHA1 1dff6a8ac8dcbe4f3b6b7ac1410bf33902c1a3c4
  • SHA512 f8cca2e611474e69c125745a2a3dccef71a4c72c5764669a7b858a1e65f8f710408ab822cf4e12a4cc4fcc303930bc5647ca2a4c79277806ce344f625a5aa70a
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPI4zjbTgX3iVRWbtHlHBDZUx:cu7e5TH2A214Ea743bMXSVAbtHlhdUx
  • TLSH
    T135233B003BE8822BF2BE4F7899F26145867EF6636603D5491CC411DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2