Extracted

• • Target
    6d64a7a088bb4461e32c717ead4d292db6bf1c51782dbd4a03d1d0ef77a4d33b
  • Size 45KB
  • SHA256 6d64a7a088bb4461e32c717ead4d292db6bf1c51782dbd4a03d1d0ef77a4d33b
  • MD5 4a3e4b8280e0fc46c8456f65cbea94c2
  • SHA1 46f93f9b1f26efa3f9c8a798168125e4455d1ac5
  • SHA512 0135ac46ac714e5bd7d3dd0756752c964744c9ede6917fc2efc5d089f102ec4f5e08b74b3b2b45b9f527511e60eee9994e25408fa0042e5a754bc437b84b154f
  • SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbuW8PIXOPImzjbqg73i6TY5lW8P0FClZRD5BDZcx:Du2M5TQif2SIu3m3b97Sby8P0FAZRDde
  • TLSH
    T136231B003BE9C12BF2BE5F7899F26145867AF2632603E54A1CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2