Extracted

• • Target
    6ffa01b479521901bb71fdbca7551b9d007438ac14da0493bbbeffce34431884
  • Size 45KB
  • SHA256 6ffa01b479521901bb71fdbca7551b9d007438ac14da0493bbbeffce34431884
  • MD5 97d0db33b68b567c3dd068cee3f05904
  • SHA1 ceba6fa4074e6679eeb432d6793da9a0d2a230dc
  • SHA512 60b646be3ed946391fd9edb06149544b166c35ff84865d2068ce31db3b6ee22d1267a8a04c050c07427d95d13ff4c0b51c4a7536f10f9ee88ec813f19b07c8c2
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9fCXtTt/PIKzjb1gX3iDvXbfFOUWIbBDZ8x:0u1YJTHcw2owuK3bSXSPfF1d8x
  • TLSH
    T151231B0037D8812BF2BE5F78A9F26145867AF6673603D58E2CC441DB4723BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2