Extracted

• • Target
    6c91d18e531c1b931202911d37b125dff0460be3f6e5272ef67dea556263cb3c
  • Size 45KB
  • SHA256 6c91d18e531c1b931202911d37b125dff0460be3f6e5272ef67dea556263cb3c
  • MD5 4be9dcd352ee3f995c31c2c9141157fd
  • SHA1 1ad0013950354e2ad75828c5b24fefc66a964a2f
  • SHA512 66cad83b8e2da42f7b8f2e2e26297144a38329fb7617df4f366b7d99221b0338f4a746e181480fd209016fab2e6a05c645e940b1915416f8c67976c98ecf2471
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtkZo3TMtPImejb5gX3iKmisuppFdqBDZ0x:5udApTNmU2lU3mSbWXSGpx0d0x
  • TLSH
    T1B0231C003BE9812BF2BE4F78ACF26145867AF2777602D54E1CC4519B5623FC58A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2