Extracted

• • Target
    5b6b3e97d3115aa4fc4d698dbdb8691a8042e8ac946325e4fbc839e62d1cc45f
  • Size 45KB
  • SHA256 5b6b3e97d3115aa4fc4d698dbdb8691a8042e8ac946325e4fbc839e62d1cc45f
  • MD5 09ad1c341540dc8e473da2493402a53a
  • SHA1 6df64a5a59325a0d44989daff70f759c842060b9
  • SHA512 6fc5aad22eb2548ea19785e9aa1763db2ce6e0fffeac8ec284b1d8b54c711d9084a8d2abd66c81ac87a30fd384d6633dd828f787d432979400f4095364d0d905
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA3/qpG3jHuPIgzjbogXRimghsK+efU159P1CNxUrn:UuKWgSJTwRf2HIM3g3b/XAzb+eM59UNK
  • TLSH
    T181232A003BE8C22BF2BE4FB899F26145467AF6637603DA891CC451D75613BC6C6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2