Extracted

• • Target
    6f60efeadfa2cddea501bfbf331eb47e78e507a3b4c902a69fb10612b3be58f5
  • Size 45KB
  • SHA256 6f60efeadfa2cddea501bfbf331eb47e78e507a3b4c902a69fb10612b3be58f5
  • MD5 956a20ba53e1dd24d704d099b72b4967
  • SHA1 fcb01136bd48a9dc106e50b08cc7986392f1a3ad
  • SHA512 4023181265c74f8b364fa4801a6ff497bb6fbfc91a17386c210e0a7771f0e74d7fb2227dc31235aa7b9c2989034f5b3c1886d947ec1afa1a0771c1c2e2baaaa8
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFylsHoPEaMPIGvujbTgX3ibKusbl8n8LXzOU7gBDZEx:MuLAZTnbg2XuuEaxGvCbMXSsbGAaq2dG
  • TLSH
    T159232A003BE8816BF2BE4FB89CF26145467AF6736603D5891CC411DB5713FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2