Extracted

• • Target
    0f6b7d5306a8c833933586ebd3971f2b31675a84b6923eff4243498fb95e0722
  • Size 45KB
  • SHA256 0f6b7d5306a8c833933586ebd3971f2b31675a84b6923eff4243498fb95e0722
  • MD5 8053515dc499762ac0e60a38b4f2370c
  • SHA1 475170d69804acfb8b63640e782521127932c9b3
  • SHA512 79435f1fb339b253d96f2de3406ea6545971c14a0bd59c98106d6393699bded0ab52ae1be25faa3871c94b02396bf94dc624f9d2fb695846911885d1ccba969b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVpuwZQaKkPIKzjbAgX3ij3ha70/h/LBDZkx:suJdpTPdI2QIK3bnXSlz1dkx
  • TLSH
    T155233B003BD9823BF2BE4B789CF26145867AF6637603D64D2CC411975623BC6D642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2