Extracted

• • Target
    c6b0fa5ffa462826e6d157c55a0e11c154c14909d67e7b39e632463a12dc8366
  • Size 45KB
  • SHA256 c6b0fa5ffa462826e6d157c55a0e11c154c14909d67e7b39e632463a12dc8366
  • MD5 d937d1dfb7c74cd39a1ece96a3721b85
  • SHA1 04e2f230ea8df85d729850bb0e533f84e5fe73d1
  • SHA512 e6b029ed66fcec73b7eda06b2a356545dc276d0bd0d036086a7f5bef7213a3833738ccf53ceccf26fb524a018fcfcea5fb97ee89f1cada98c0b2f5af6702c688
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjLS7synzuOPIzzjbXgXYin7yMBmycrqZUoqBDZ8x:0u2vpTDe+2gSYh3z3bwX1rQprqZUZd8x
  • TLSH
    T18F234A003BE8812BF2BF4F78A9F26145867AF6636603D54A1CC452DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2