Extracted

• • Target
    6b835e5e3821b86391da7286be6bfdf8a9160949341b04b010e71ffba6428e04
  • Size 45KB
  • SHA256 6b835e5e3821b86391da7286be6bfdf8a9160949341b04b010e71ffba6428e04
  • MD5 b38870241b005068af691917cdef4f70
  • SHA1 b34a6aafdbf259d96777756500d65a715ba515ef
  • SHA512 1818ef4cffa52aa6ba1b9a37845a140f7c7a98678e0b01cdd2a65d22da1a5e7d53837c51251cfe14785be2a739d1e0cccece8260ad537b014e411e87ed6079b4
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAkQLDivyvtAjZPI7zjbLgqirEZQzI1zqjfe1BDZMx:kuSOpTPOP2U2iaGjW73b0Trjz4zqjGb8
  • TLSH
    T1C0232A003BE9813BF2BE4F78A8F26145867AF6772603D5491CC451DB5623FC29A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2