Extracted

• • Target
    6eb9fa4824d1cfa3c819e537da2f01606830a8c906e0c3ad000dc24042afc2ab
  • Size 45KB
  • SHA256 6eb9fa4824d1cfa3c819e537da2f01606830a8c906e0c3ad000dc24042afc2ab
  • MD5 8e566f9a0cc6a9ea5b04a0c294fa8e0c
  • SHA1 ffa8a7dfd7cab6ec2e0851fc6a319c85d7f06e05
  • SHA512 b68ec0efb8d12417037d6ff0256dd308cbaf0a2e956efd1421137f73983b6317a649a8075b27c0e98a7342a2b18df764e3fa411f4ca81662ec24f423d88e1b83
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCMhdjCvS8PIj3jbSgX3iEd2AI/x4Tyf63BDw:MuBGJTPho2Q/CChBjTbVXS5X5BixdEx
  • TLSH
    T190231A003BE9812BF2BE4F74A9F26245867AF5633603D64A1C8451DB5713FC68643AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2