Extracted

• • Target
    6037a98a779ba836e4fbe4eab7d3ad1aa644f59a72057ea9d114f3ce22d030d2
  • Size 45KB
  • SHA256 6037a98a779ba836e4fbe4eab7d3ad1aa644f59a72057ea9d114f3ce22d030d2
  • MD5 e7e8bcd0af57e2726be2c4ee2ff43138
  • SHA1 02d93bc6201a0e5b0b7adcbd6fc1a371fcf0d76e
  • SHA512 91017f011cca7b53ae520ee5b86dabebd6af407e541a7ab399b8f7b0286204de293243120506a2558fa9eededfadb3e457609dfe18222b0487f9bbbc6d8b1f1f
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1YpW+VgO8tPI7zjbOgX3ic/h4QaqXFJBDZUx:cu6YepTPso2RRF73bxXSS41sXdUx
  • TLSH
    T134231A003BE9813BF2BE4FB89CF26145867AF2633602D6492CC451D75623FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2