Extracted

• • Target
    6718ad7bd9d41130a5e3124c2c451a0eaec656122b87e17e217a8fae79c1cb06
  • Size 45KB
  • SHA256 6718ad7bd9d41130a5e3124c2c451a0eaec656122b87e17e217a8fae79c1cb06
  • MD5 520b94d48ccc678c6f61bab739a5adb6
  • SHA1 8a8069c2876c011a5b1dcb33d2aa39b37b19130e
  • SHA512 d40f3eccdf519e56c50d1a1168329837fbe571eb0b1387b846064ceeb982b158fe0d6b43709548fb183c7b893140e85146217edf6b88666d5846bcc4e9592eff
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1ucP0pycvHPIjzjb3gX3iHr0/9Z874gihT+BDZUx:cuR0JTPjY29ccMcvgj3bQXSL0/9ZwFX0
  • TLSH
    T1BC231A003BE8823BF6BE4F78A9F25145467AF2672603D64A1CC451DB5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2