Extracted

• • Target
    6b6edb373104c9e4c777871ace09e9a5655076455660831c500a98aef9d3ef80
  • Size 45KB
  • SHA256 6b6edb373104c9e4c777871ace09e9a5655076455660831c500a98aef9d3ef80
  • MD5 54ed77d10a9ccba29201b6f978b92f2b
  • SHA1 80502540efed65b7dc275776943bdae5d94e70fb
  • SHA512 fafa5d91cddbd0af1243c126be5420f2c23d044cbfd997036d548114a21ae8c5f10406a855a5247308450780e9316812f8d3dcdade8d50df63cfcc1a6a10d6f6
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtEK1YJBOPIxq7zjbTgu3ijY0jN/35VOvmBDZ0x:5udApTNmU2miz3xS3bMuSE0jN/35vd0x
  • TLSH
    T1D7232C003BE8822BF1BE4F789DF26145867AF2673602D54E1CC4519B5613FC69A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2