Extracted

• • Target
    c6ab4c8307ae05a14a97881c96b919dcfda41c622c68bb22b54df3fc1b92aadd
  • Size 45KB
  • SHA256 c6ab4c8307ae05a14a97881c96b919dcfda41c622c68bb22b54df3fc1b92aadd
  • MD5 fced9a25545878010615019154c86e8f
  • SHA1 3adb1aefd26481f42fc9451852dd8d344890a462
  • SHA512 43785ffe39554f705233e3b669bb212f3c8f9d7df0656a7290a8b1596f92361278a299f15f1d61c8f616aed44ff4898ac87ebaadfd3eb5cc63ef81e96af97b65
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt5HO9YjoHPICYzjbKgX3iPTSJShBJRXrHNBDZ0x:5udApTNmU2Z6kgCY3bdXSPGJ65Dd0x
  • TLSH
    T1AA230A0037E8822BF2BE5F78A9F26145867AF2633603D5891CC451D75723FC6CA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2