Extracted

• • Target
    6413774021e6188a1c910c1e9036489c2cf0c7cffd831ba7ecc5888e952a1384
  • Size 45KB
  • SHA256 6413774021e6188a1c910c1e9036489c2cf0c7cffd831ba7ecc5888e952a1384
  • MD5 0484336206738f1229691b7aa6497925
  • SHA1 3211d2a6a2d947624d28c308184553f8f3c8bfe3
  • SHA512 b66b2432057ddd422185cca9bac67274922d4fbd7492a967a5fea9b8825f5dd10fc2d7e143edc7fbfd9d6d596d659f1363b23972f6d9b369b582ab06616b64c0
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9dORo4CBQvCNjPIUzjbugX3oLOSvVZ5zfBDZTx:QuflpT8Hv2sORbPCKU3bRX4Llz5zpdTx
  • TLSH
    T1E8232B003BE8C12BF2BE5F7898F26145467AF2633603D54A2CC451DB5613FC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2