Extracted

• • Target
    c6f2c515ebfb99c20887cf77bdae277231b2795cac8825e88b3244ee8cb278c8
  • Size 45KB
  • SHA256 c6f2c515ebfb99c20887cf77bdae277231b2795cac8825e88b3244ee8cb278c8
  • MD5 08bdb05225e0b6638910dce13c1d28fb
  • SHA1 231d61370f54f2f91fa683e8e0450b03c53ab62c
  • SHA512 240b355f0e8ce339a7644bb7ab632edcbc2d6617b8279f8a5b66eaa9488315787113be7352f16ead6b519a1fadff4599a02b9206fd3e109affce5a513ba7580c
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql3seXusMkFX8vnPIMvzjbWgX3Q4Ua5LIBDZMx:wuDWZTpMZSB2deB1FXiAMv3bJXg1gSdO
  • TLSH
    T1DD232B003BE8812BF2BE4F7899F26245867AF2633603D54E1CC4519B5713FC58A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2