Extracted

• • Target
    6b3506fa5ba701d76baf9d0f483bec2ed00c30d146c6f94b261e8b0e634f5795
  • Size 45KB
  • SHA256 6b3506fa5ba701d76baf9d0f483bec2ed00c30d146c6f94b261e8b0e634f5795
  • MD5 6d7fab50fc62a9378fb67713d7c29501
  • SHA1 d94a2eada3190477bbc48a83e50f0c11ba45941a
  • SHA512 77ee2d2e05a27759189399d4ff9b6ed00088d5f31f17c0e2d357275a854be5f50c2eb0b5ba75d0ff825dd7a420d780c6ff6e045c9486877fa61a5d28ea17f438
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA3/qpG3jHuPIgzjbjgX2i6a49nuyi4H5BDZcx:UuKWgSJTwRf2HIM3g3b8X/Uvndcx
  • TLSH
    T126232B003BE98127F2BE4FB898F22245467AF6637602D6491CC451DB5723FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2