Extracted

• • Target
    a6b81c36ff399541865ebf4e525b1038a14ae3fd8a80b2ea5123130d18338aac
  • Size 45KB
  • SHA256 a6b81c36ff399541865ebf4e525b1038a14ae3fd8a80b2ea5123130d18338aac
  • MD5 6725482815c6520cd5c528c7b8f92ad3
  • SHA1 d4cdd1c1c320d9726ce55b6d1592d64f16c53522
  • SHA512 879be0f3d301b188fdd5a92977e602c5880d747195a31c6211bffccc8744137b2be46d1790eec72dbc11bf040926b7a8bb9eaa972b0ca4b483d7615c9ab06e58
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA3/qpG3jHuPIgzjbMgXpiTcvHNJYIEB2k2/FBDZcx:UuKWgSJTwRf2HIM3g3bDXYTcvHjYBB2e
  • TLSH
    T13E232B003BE9C52BF2BE4FB8A8F26145467AF2637603D6891CC451DB5613FC6CA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2