Extracted

• • Target
    6fe6a2bdbe591b718c32d0cd4f21654f14554d3dcb4e991612f62ae16e0a1c8c
  • Size 45KB
  • SHA256 6fe6a2bdbe591b718c32d0cd4f21654f14554d3dcb4e991612f62ae16e0a1c8c
  • MD5 765ca09912053678b7d5068d2b5f6bfd
  • SHA1 ca3dc45184ece30a06c8a0548149faca5545927d
  • SHA512 7bb2651c5364769fd4ccc5277348d97c9b1f66217e4daab3f41c5e5cad7300ced715cc920892667f53b7669018746dfa0ae2f309bac4f7c677fd97c7bf93e02c
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBAPSNjPIRzjbBgX3ipvdcA/606bBDZsx:EufspTf2g2hO5svSKR3buXSpvdcmodsx
  • TLSH
    T1BD232B103BE9C12BF2BE4F78A8F26145467AF6632603E5491CC412DB5613FC69A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2