Extracted

• • Target
    6ff4dfb34d2568b2d91daf55728bb05d01fa018be4cc89c4da7259a3ccd6ad15
  • Size 45KB
  • SHA256 6ff4dfb34d2568b2d91daf55728bb05d01fa018be4cc89c4da7259a3ccd6ad15
  • MD5 6bd50705202269b0e280f5baf7e6c532
  • SHA1 fc2443f1d18b18755683e5292c30cbec939264d1
  • SHA512 c9d49a5c32142311350b392618a2c0a1703cf1685339bcf96fc4493c7701a07ad19b61dcf2397983ea208a2724a6fdffd1aca31a56ff8e847d4ac7642c6ac01b
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtNZatDMVPI8KjbdgX3i4I8Zu62WERlbd1BDZ0x:5udApTNmU2GwX8GbKXS+Obtd0x
  • TLSH
    T1A4232B003BE8812BF1BE4F78ACF26145867AF6673603D54A1CC441DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2