Extracted

• • Target
    6860af145f9007a715f2de9933f51fb471003973c78842d02d1c167aa4b91dc7
  • Size 45KB
  • SHA256 6860af145f9007a715f2de9933f51fb471003973c78842d02d1c167aa4b91dc7
  • MD5 c43fa2fe54dc3bf6433d4871a3be3dbb
  • SHA1 effd83fd0fb54d2f03df430e2bfcde15505d0d4e
  • SHA512 989132cb47e870c2cac43daf800f71cf7ca536349a00e1aad4a022a96bc738e851a5ede27bea55640d27b4112490a470bc98d732a0b1abb5c9a48dc6f09206b9
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAr0b3NEAteiZPISzjbEgJ3iK9BKe0X3vNnBDZMx:kuSOpTPOP2y3ehiWS3bLJSK9Yf3VBdMx
  • TLSH
    T12D231A003BE9C12BF2BE4F78A9F26145867AF2676603D5491C8451DB5713FC68A03AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2