Extracted

• • Target
    6f11db4aa2b5ad8ccbe92aea14b7adea3c1dde653755cf145ee4906edcc58ad9
  • Size 45KB
  • SHA256 6f11db4aa2b5ad8ccbe92aea14b7adea3c1dde653755cf145ee4906edcc58ad9
  • MD5 1cb1b0962c472d6b0fe8f22d85249f18
  • SHA1 0a6fbc34c5200d81be2e8e7bf527e09d2da34aeb
  • SHA512 b2479588f489dc9e57868f8a5a2963e6b3af97e2d4d9365dd4ca839efebd8b69b73b125a28a9cae2c5630d4c646fbafeda513fee76c836a9c0cb62e580cde6db
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVPmaPol53APIkzjbHgX3iHsZ76Y7VF2U4cxJBDZkx:suJdpTPdI2efob3lk3bAXSI7xVQUldkx
  • TLSH
    T1A523290037E8813BF2BE4F78A9F26145827AF6673603D64A1CC451DB5723BC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2