Extracted

• • Target
    b6286c27e83ad408a37f4457370c69f48dacb092b23df3af6811049a3bcdc2c0
  • Size 45KB
  • SHA256 b6286c27e83ad408a37f4457370c69f48dacb092b23df3af6811049a3bcdc2c0
  • MD5 2cc63f5538d33074701ee78688dd24db
  • SHA1 50f23f335fb0bf3683375cacd72109556a9f4372
  • SHA512 91561f6a01f41085f60a07439a725279c4a7065c1ae72b3f45a2639c96d4c76698862b69c909fc8c306f00e98f0c946e414c69602e4a4fba1b713a4ed456e92f
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PIBzjb/gX3iew+FVu4cIGB0T+sBDZUx:cu6YepTPso2GQB3bIXSew+FeIuCdUx
  • TLSH
    T104231A003BE88236F2BE5FB899F25145867AF5633603D64D2CC451DB5623FC28A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2