Extracted

• • Target
    6008e967bd255a052615bcdc6bafadb0b34529a4b39cccdc42845a80cea5b4bc
  • Size 45KB
  • SHA256 6008e967bd255a052615bcdc6bafadb0b34529a4b39cccdc42845a80cea5b4bc
  • MD5 a7c4247e838e245aa3de7b7ab4bc1ee5
  • SHA1 36065b17d27aab68009ff380782aaaaa3ca106a3
  • SHA512 798766e5f4fb8ccce478855818a5e5a5c73d62faeba5a0b6aac242baa62d4653e6a8dc4ead44d949ddde08eb73cfb0706da9c88c20052e838a8c2859192c68f1
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QPCBAPSNjPIRzjbngX3iBdyoFVVVzqlBDZsx:EufspTf2g2hO5svSKR3bgXSBbFn1qrdu
  • TLSH
    T1E9232A003BE8C12BF2BE5F78A8F26145467AF2736603E5492CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2