Extracted

• • Target
    6a852a06bed226c2bc9f248a1d7ce64d675e5b2300d1f4b19893028b3f6bab41
  • Size 45KB
  • SHA256 6a852a06bed226c2bc9f248a1d7ce64d675e5b2300d1f4b19893028b3f6bab41
  • MD5 d5ff058be2759007d2950e1a5e792b10
  • SHA1 303db34e88f4b42203d18effd95b96233ccdfa01
  • SHA512 c4921c4302cdf05913d0a0e222555dcfcddd58711b5f6191379e289d924c932144a262850d8c0650ead1d1147d5d840dd57479650f0e6c4789da234a7871e0ec
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1SVkIpeUGcPIxzjbvgX35RuqfNJymmpGTkRHBDZUx:cuR0JTPjY2rVL4UGhx3bYXJTmmYGTIh0
  • TLSH
    T101233B003BE9823BF27E4FB898F26145867AF6632603D6491CC451DB5713BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2