Extracted

• • Target
    6aa504caf8c49f5c5e1bdeffd3920e2a9f680575bf76751adf1330fa13e08baa
  • Size 45KB
  • SHA256 6aa504caf8c49f5c5e1bdeffd3920e2a9f680575bf76751adf1330fa13e08baa
  • MD5 0fc214b1c3ddf135435ea6ec795649d0
  • SHA1 94d65a1a05072b4e2c546709f604d02316f287be
  • SHA512 8986f087b95fc4e31b390137e139bccf90c69fddae71be116879adb149563353f028bb6c696f37d7c1794f8c94eca5862dee7588bc14b5bf4cc76430edc7ebfe
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYzOEfxFNbsOPIMqzjb+gX3sCAdRWJYs3dyKeZD3Czoq:8uuSpTgyf2LxXg3Mq3bBX8/wHtIZNld2
  • TLSH
    T157231A003BE8822BF2BE4F789DF26145867AF6633603D5491CC451DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2