Extracted

• • Target
    de6d0fb909ce35099b60c28f39e34c61324828af2baea4e8fa89c6f4b37f9b1a
  • Size 45KB
  • SHA256 de6d0fb909ce35099b60c28f39e34c61324828af2baea4e8fa89c6f4b37f9b1a
  • MD5 4253328f8e2a9a9b6fbf099d1ee46eb7
  • SHA1 c860c8b447ebbe22dac34391f23bf8950fd3f269
  • SHA512 0860c1af83f998714d214bfb3f3c34ef33808645709bdb8d681e71674585ebbdc49cd16e2927a35e631c0f990503c9607fd007c289361b40e50e00a58dd747ae
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA+VlcVl6GcPI+zjbvgX3p7G5351GP0HIqVevNrY1WQw:kuSOpTPOP2OV2X6Gh+3bYX5653KsHEBn
  • TLSH
    T1B8232A003BE9823BF2BE4F7899F26145867AF5636603D58A1CC451CB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2