Extracted

• • Target
    6f0dbf53bd8ab1d80951679a55bb6fdedb5e0a29f9bf673416f1d530fe64f443
  • Size 45KB
  • SHA256 6f0dbf53bd8ab1d80951679a55bb6fdedb5e0a29f9bf673416f1d530fe64f443
  • MD5 8d1871e364ac3cfed9732cf97f021406
  • SHA1 faf1cee04af75f29fabc286b0fc833ab092a3143
  • SHA512 58a8be1fc9aedef7b5d59cd1bc0bc0ad677b0d339f5ce13310ae553af8233ac1bd112e3d7dd8b59e1a2a8519052da206957be4601bb4f81d3cee67adbe7122ff
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdjYkk8PIuGjbpgX3izz/lQupWIMBDZMx:wuZ8pT1tc2KLBXQBuqbmXSX/lUXdMx
  • TLSH
    T1B9232B003BE9812BF2BE4F7868F26245467EF6732603D5491CC451DB5723FC69A43AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2