Extracted

• • Target
    6b6c3d4c29305e9237f530694a0cef617f5ee1d73c810e36c886a982b51b6673
  • Size 45KB
  • SHA256 6b6c3d4c29305e9237f530694a0cef617f5ee1d73c810e36c886a982b51b6673
  • MD5 dbcc2701321744dcc29b3502a25bed16
  • SHA1 21f3f7b0e6f4b9cdb127de7c4109d6f60bfd9d92
  • SHA512 33428d66cc83c876afdea9649ff18b19346c85f9d8eaefa7d470f2aaa8e9a43101f31810de9b1858aae42ae388f72a3b673e4a9ca227ba7cf89273662f19f83f
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAbgzZUpx7PI8+jbJgX3iKVHZ1OBGq+wRO/i1BDZcx:UuKWgSJTwRf2ron8ybGXSuZxwE/Idcx
  • TLSH
    T154230B003BE8813BF2BE4FB898F26145867BF6637603D5496CC4519B5B23FC58A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2