Extracted

• • Target
    6ee897ca6069beb69e0cf73860b448760ffd222c5983e671970b429196ab1b2a
  • Size 45KB
  • SHA256 6ee897ca6069beb69e0cf73860b448760ffd222c5983e671970b429196ab1b2a
  • MD5 1006497661c8df0e1e189fa411389667
  • SHA1 cccfb3958b528aa43a80dca0efce35f5c3fa0b07
  • SHA512 ddff3c7d92efd3726e21e76975da619a704d5e957967c0c5ba5bc39decfdb332be01c37b60f1506626c9942ba09ee17f9c4591551383b2a6642f9984220f86a1
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwkSAFcKoabbb4ZhM/RPIAEzjbUgX3iz8QOqfUnOwlI:ku40ZTXEb2oSAvQZh6OAE3b7XSzzTfcg
  • TLSH
    T1C9232B003BE8812BF2BF8F7898F26145867EF6633603D64A1CC451DB5713BC69A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2