Extracted

• • Target
    6b30c2e7001b3be5644eef5d63d36b862a8b8eb0fe0faff6cd580ad75fbcd3d9
  • Size 45KB
  • SHA256 6b30c2e7001b3be5644eef5d63d36b862a8b8eb0fe0faff6cd580ad75fbcd3d9
  • MD5 3fdd21bc9d38dd60ddf8d688ee6de1b9
  • SHA1 07fae07f63401a24f6701efa521292d0b8cabe1d
  • SHA512 a2ddb4cb38018fc2aa5f10c6eee9eb3f74da4dc2ad0bb52064ffacb9fc63a7a9d776413d78fe096ca3402df5871b3c1354a3242e2f2ba57aac77e331a0e87dec
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMzjHy/aKPIbyjbvgX3ijGWgbaW3n8TLY5mdG+++Ae:0u2vpTDe+2FnhbebYXSjGWSNXgk9+XWM
  • TLSH
    T1CF233B003BE9C12BF2BE5F7899F26145867AF6633A03D58A1CC4119B1713FC6C6526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2