Extracted

• • Target
    6ba58880771a7fb3770d89d4bf1b8ca43fadaedf9ac4c8bad9aad2570680c10a
  • Size 45KB
  • SHA256 6ba58880771a7fb3770d89d4bf1b8ca43fadaedf9ac4c8bad9aad2570680c10a
  • MD5 b94275c487b0b62a1eb102f7711517fd
  • SHA1 affed329dca4e3391b5bb0e16f65e0c0e189dae5
  • SHA512 f8d0394d1b4102e91675bbb2200033540f62debb0a08d2aabb19241fc3bf18f08cf1588cf6eaa3bd0f16c97420989f265c87a43e36e800b71618bb07f221325b
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwL3FodEaOPIHzjb8gX3i5pX4C7khp0GcKBDZMx:ku40ZTXEb2lUEa3H3bTXS5pX4+k8sdMx
  • TLSH
    T138232A003BE9822BF2BE4F789CF26145867AE6A32603D54D1CC451DB5713FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2