Extracted

• • Target
    e6b19f64f032fa93a3c088eeb91ae99182bc39e8827fd9fe8915796622358dc6
  • Size 45KB
  • SHA256 e6b19f64f032fa93a3c088eeb91ae99182bc39e8827fd9fe8915796622358dc6
  • MD5 d44019926f1930b119445035bec6eca8
  • SHA1 bdd7bae15b3d0a5477e758fc587fe87c5f3f4903
  • SHA512 daf536da679d06ab51d17f6f2a21db49cb47a5dd8ef4e0dec9eadcc3fc5b9ca43e4a149d27651c2ea1c24862b56292567800240fdee1a2cf0422a2e6915a5b63
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ43xY6AZOOPILzjbxg23if1rmyQipQTZBDZUx:cuqb5TrhG20ulO3L3b+2S8TaQTdUx
  • TLSH
    T1BD231A003BE8812BF2BE4F78A9F26145467AF6733603D64E1CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2