Extracted

• • Target
    6d7b8039c1cabcaff193bac2f758ea84e3efe6e8571cdf102752444f1d5b0885
  • Size 45KB
  • SHA256 6d7b8039c1cabcaff193bac2f758ea84e3efe6e8571cdf102752444f1d5b0885
  • MD5 4a9f42a07549c42f152f4a9d445da3f2
  • SHA1 c756a732e66002cc72a886a10ae1f00e132c2141
  • SHA512 3b620c3b4a25f9015333ad45c3586b77aa6b95940efa756e6a673be460f59e21c6b91dafd40e39e715c3ccc6270ada5cdf76a2c7adf1a581c07575f7e4862e84
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9K6qcyvzlOPIozjbvgQ3iNYGnMss6AYRgmBDZTx:QuflpT8Hv236lC3o3bYQSqGMCAYFdTx
  • TLSH
    T1D8233B003BE9812BF2BE5B789DF26145867AF1632603D64E1CC451DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2