Extracted

• • Target
    6500e8bf8b9e0c0cefcd9330ca4564249c7539191ec76d4dafb455baf8b91b1a
  • Size 45KB
  • SHA256 6500e8bf8b9e0c0cefcd9330ca4564249c7539191ec76d4dafb455baf8b91b1a
  • MD5 18b9a36e2b16f34202dfc7d5bfccc308
  • SHA1 ad5ec199384959f617e14b961843ea3b6460b6a8
  • SHA512 f5bb09bdbd74f1ad5dcddd6009f0abcdc731523619eaab1d418579e6131e64314017c64fee6707a74097355938418d29df35687fa4fed8f79e4ed88fd8343c5c
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAQBz3QKx7PIQQjb3gX3iRgpP1CRFJYuqbOiBDZcx:UuKWgSJTwRf2gV0QYbQXSmPe76dcx
  • TLSH
    T1E6231A003BE8823BF2BE4FB898F26145457AF6633603D94A6CC451D75623FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2