Extracted

• • Target
    6dcbb505f2131709c1336c5f9d5c4121eadf0ba23a286b2af14e9de458a9387f
  • Size 45KB
  • SHA256 6dcbb505f2131709c1336c5f9d5c4121eadf0ba23a286b2af14e9de458a9387f
  • MD5 ac83fbf7916ab9115eaec5d6d01b3a9a
  • SHA1 449d3097590834362d9568c9bb0e19b257ace9f1
  • SHA512 b5a92831ba2a82151246bd23f22f1b5e83048415aa71935a35ef4fe696d6d4d7f4f8af60d7bc16d55deaace2b33a5a70fc19c4c3ce935888a2d9ac1bedf2585a
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAW0ewtDc30oiZPI/zjbYgX3iG0u8zD0048HoXVBDZMx:kuSOpTPOP24wR2iW/3bPXSy8X00xC7dO
  • TLSH
    T1DD232A003BE9812BF2BE5F74A8F26145867BF6632603D5491CC451C75723FC69A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2