Extracted

• • Target
    6b455cc9910c0be1a884857ce4baa3a640f14c9ae07ccf2a7f410b2c7e657c23
  • Size 45KB
  • SHA256 6b455cc9910c0be1a884857ce4baa3a640f14c9ae07ccf2a7f410b2c7e657c23
  • MD5 50a5afb8f7c427d96eb646a5728a9fa5
  • SHA1 fb31ad22dfed8884e0895bbf92fbd18d81866388
  • SHA512 1a58df2ae847830b7a03823363dc7ace694c3bcb5084abb2a8e44d13a4ecdce773e791f2a0c5c46ec7d735ccc12f4593507bff2a3300e258807a7b2fd22b647a
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1dnCablx3APIvzjbSgX328b/7FpNfsEFMxBDZcx:RuxkJTgip2wjb33lv3bVXmY5DfFMPdcx
  • TLSH
    T11C232B0037E9812BF2BE4FB899F26145867EF1637603D64A1CC451DB4613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2