Extracted

• • Target
    6796e4e8a00d9425e667a763521f9c255bdd1da4ed481b709fc74a8966194b2c
  • Size 45KB
  • SHA256 6796e4e8a00d9425e667a763521f9c255bdd1da4ed481b709fc74a8966194b2c
  • MD5 71f1805157b9dd487c7861678f4704f1
  • SHA1 c883582cb36959ae865d7403059d0d9522239536
  • SHA512 530d06e67645819f3655c9d7a8679561ad64bde887463a80639efdb6efd0e69c37781379648c9360329396c9b2cf7364f39a58706ef164cc80bdbe98bae351af
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVCT2Qpm7PIK1jbIgX3iO8ojL1DYIFXQaiBDZkx:suJdpTPdI2+eKdbfXSzC1EIF/cdkx
  • TLSH
    T1B2231A0037E8822BF2BF5FB89CF26145867AF5637603D54A2CC451DB5623BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2