Extracted

• • Target
    6804969fae738d3261e78e5486cf54d0f5258b7c1e631aa3b0c95e4198797deb
  • Size 45KB
  • SHA256 6804969fae738d3261e78e5486cf54d0f5258b7c1e631aa3b0c95e4198797deb
  • MD5 eaa89a34691ef80bcb3095a4fc7d94a8
  • SHA1 957201411951cec288ab6f19fb0b4e39d2e6a9ca
  • SHA512 4d71b3348094794548fa593dfa03b86fb7c5c9af561763cfd9ebd8ddf3eb8aca9b9ade131a847c9a47bc95117c279784d5b4ffb3da7248bf530f23fae5658a56
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1/fPLzizpvtLjZPI9zjblgX6i/ZRkmr7kM9vYzpPiu:wuZ8pT1tc2WfHi1VjW93biXDRRkmHkM2
  • TLSH
    T161234C0037E9813BF2BE4F7899F26105867AF6673503D58A1CC441DB5A23FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2