Extracted

• • Target
    6a7fdb14922c0a1a2ff0f77b22c6a1dbdabcc5c163604b91ae716359bbfaeef1
  • Size 45KB
  • SHA256 6a7fdb14922c0a1a2ff0f77b22c6a1dbdabcc5c163604b91ae716359bbfaeef1
  • MD5 e6a3594244306abf0a2a70196f28dba3
  • SHA1 c5475e62e75a6648fd267640f783a6e7cbb40d84
  • SHA512 0d342ecb84dcd94d06d3d6b49efa3aaf077e9bb3aaa98f6f326972c5d966c645f99e5464fc7f20fc9465d2eda16bd820a9c3614deb62e2501b32d95c80ae6b78
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYNCXtTtoPI6zjbQgX3ilXJDdDCwlOJpBDZ0x:8uuSpTgyf2lw363bXXSlXJZDCJ3d0x
  • TLSH
    T1F4231B003BE8C12BF2BE4F78A8F26245867AF5673603D55E1CC4419B5623FC59A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2