Extracted

• • Target
    c6492d587853b46d2a5d304c4948798c03129e2260d7bebc6862789a2193545a
  • Size 45KB
  • SHA256 c6492d587853b46d2a5d304c4948798c03129e2260d7bebc6862789a2193545a
  • MD5 b94e432796d2bace19e906ab11e45215
  • SHA1 0b402a2d5acde4cd96f29893f16d11e806b7190c
  • SHA512 1504f4505470cb84c277661f3a7594cd7f073df6659f43e62ffcaf259a9c058ec4a4d15f0340497d7b785bfa762edcb45f5eac410ec774e68995d855930aa1e6
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QyCBjHSNjPIwzjbEgX3i/EVQSAz1BQq1cBDZsx:EufspTf2g2hO59ESKw3bLXS/EvAZGq19
  • TLSH
    T12B233B0037EC822BF2BE4F7899F26145467EF6633603E5492CC441DB5613FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2