Extracted

• • Target
    006be75173a7e7ac9cf800757c2abac278d45058d3c2782b62c175467f0e851b
  • Size 45KB
  • SHA256 006be75173a7e7ac9cf800757c2abac278d45058d3c2782b62c175467f0e851b
  • MD5 eab5e52d14a12f9729da438a83a9b175
  • SHA1 183d081a1e0a58ddde1157795e32dddee68e024b
  • SHA512 5f926c04b1e3bc64cd820f0078d367520ce9d53fdcfa2e75a217b7104b30eda4e56bfb3ab3ba9e769c8e63c736dc5b8f8ce0ae3d4b47f2c98292180736682558
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVLGsGx8OHuPI2zjbOgP3ilaZQt7o9NBDZkx:suJdpTPdI2mez323bxPSlaZA7mdkx
  • TLSH
    T12D232B003BE8812BF2BE4FB499F26145867AF6673603D54D2CC451DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2