Extracted

• • Target
    6779eb6b063cbf2d7e7f7ba217b1f2a4a6205e1bb072e0353761a33022e4c080
  • Size 45KB
  • SHA256 6779eb6b063cbf2d7e7f7ba217b1f2a4a6205e1bb072e0353761a33022e4c080
  • MD5 a7ea140d9fb66b4b755764032ebcccf0
  • SHA1 d206c3c80d4814fc9576ed6a4bc83c563cf2ea1f
  • SHA512 3cd968680153a7855a7c60868f561b26d08692b77e066874b8ae4cbfee7e94d1541178d53b111a5e6a1253ffd95ba835be640ba18f18e62053be91d0492b3774
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPylF3APIFzjbCgX3iRcoxmH4fkZBDZkx:suJdpTPdI2Hfyv3lF3blXS3xRfSdkx
  • TLSH
    T1BF233A003BE9813BF2BE4F78A8F26145467AF6637603D65A1CC451DB4723FC29A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2