Extracted

• • Target
    6582f09439676a5e95627fc223f688bf075905e2e8bff87725b1ce6443ad8610
  • Size 45KB
  • SHA256 6582f09439676a5e95627fc223f688bf075905e2e8bff87725b1ce6443ad8610
  • MD5 d2fc2fcbe247a56e2a00d5d0b06d8209
  • SHA1 6033b5f3df472542dab977bf93529e45691ac2eb
  • SHA512 e3af438f40c55c8e56df5f50c89e553db3e7d643f5d68944b4dd43e967e397d9c89f2a5f917ccb9f80c2f7d5e9a5c7a47e70370500f9325c535c095bc7c8d844
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYj583IkOPIdzjbkg73iBx4pIi/bLBDZ0x:8uuSpTgyf2tAF3d3br7S/4pICdd0x
  • TLSH
    T1C023190037E8C12BF2BE4F789CF26145867AF6673602D58E2CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2