Extracted

• • Target
    6ac24bead5dc11d7afba0c0291057154858d5c5c7e874d999841ddde9b20c7a8
  • Size 45KB
  • SHA256 6ac24bead5dc11d7afba0c0291057154858d5c5c7e874d999841ddde9b20c7a8
  • MD5 04a4bae18cee367bc232431d995cc3f8
  • SHA1 963a9ca17f6bf638193b826abb4787dee771340d
  • SHA512 ed55d230b15592c004ebf121a6994a51e452ee75df9bc89f7d4481496719773a476c26ace5b0733948d6a7a510ce569906b9f663e9f5141034dd0628c4bec634
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYxoTXwJZPIOzDb2gX3iBQ0UbJYUFIbjBDZ0x:8uuSpTgyf2aLfO/bpXSYNFIbld0x
  • TLSH
    T15E232B0037E8812BF2BE4F7898F26145867AF6673603D58E1CC451DB5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2