Extracted

• • Target
    6a09e25d077a43f7031af87f04617ddd47411bea8163a7f3ddf6976b7c9ea080
  • Size 45KB
  • SHA256 6a09e25d077a43f7031af87f04617ddd47411bea8163a7f3ddf6976b7c9ea080
  • MD5 db22c28e3e1baeae0256b9cfe3f16f2d
  • SHA1 f126aa856258be79ef62cb378ccbd0a56546f629
  • SHA512 91ea657bbbf7025dce0f36069d21588a302b635c713d04d8d4f7ddbaeded3a47945b759924248f075bb6b5c74a3fb5bd6c07e0f10a67abe679e6f70d5cd67e9a
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9yhkTwJaOPIcozjb8gFiXMN0E3HV5BDZ8x:0u1YJTHcw2U0w3co3bTUXVE3dd8x
  • TLSH
    T132232B003BD8822BF2BE4F78A8F26145867AF6633603D58E1CC451DB5613FC69A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2