Extracted

• • Target
    6aa9abbc03ffa97a0a659980a636dc30707314f349d5433e97a72df41b0de8ab
  • Size 45KB
  • SHA256 6aa9abbc03ffa97a0a659980a636dc30707314f349d5433e97a72df41b0de8ab
  • MD5 95dbf80b165ae3bef0a0f342ed013a1b
  • SHA1 daed7b72079ba19e50ff67cee6e9346f75e876c3
  • SHA512 3f70591b2a8a013b32897a27f9682185afd5c0a777d5bed5d546330af2ac8b7ad25fa7007d2733059284e5b3d5e04484647c3d5db075b3ffc218c25114f62611
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAbgzZUpx7PI8Cjb1gX3ijS9ZmvJofbBDZcx:UuKWgSJTwRf2ron8ObSXSTvJofNdcx
  • TLSH
    T192232A003BE88237F2BE5BB858F26145867AF5632603D54D6CC451DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2