Extracted

• • Target
    6fa4acd321c47f7a60bcc772f305e2074cb5bd013407dafef52f4d9e45c809e4
  • Size 45KB
  • SHA256 6fa4acd321c47f7a60bcc772f305e2074cb5bd013407dafef52f4d9e45c809e4
  • MD5 ea2ee37fb392f983bb1ece6d36052521
  • SHA1 0153d9bb04e74a25c02116a1178041e2822a517f
  • SHA512 9991b598fda0128a0a5d2c8bbd368b39dd62a45c22a4c4505d413e58fe5addeb62d146711e78a4033261a398c89c0712e356e6077d35dfe5f50de98b0f2b41bc
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF4ZTohEaSPIFzjbWgX3isbYNmVtLfxd6sgeBDZUx:cu7e5TH2A214Ea7F3bJXSsbY4Vh5VdUx
  • TLSH
    T1E9231B003BE8822BF2BE4F785DF26145867AF5736603D5492CC412DB5613FC6DA42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2