Extracted

• • Target
    6beeeb940571dbe9a15cc42eadd214d16f1818eef2afc5e09a5d8efbd46d9ddb
  • Size 45KB
  • SHA256 6beeeb940571dbe9a15cc42eadd214d16f1818eef2afc5e09a5d8efbd46d9ddb
  • MD5 5149380a55b719002649f9cca3ea3bd6
  • SHA1 2c0097306832f51323edc782e52eeab94a438549
  • SHA512 f6f83b5741abca1fcad1a1b092110718712409ca610b744a99bd9ca8f56fc05cc4e50cbd8a7b15e0d857b2d6ee478c64091a687c189eef278fdbb31aa497900e
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZo3TMtPIQajbtgX3iOL/ZALRD7TMfPXUEvEv90ue:0u1YJTHcw2dU3Q2b6XSOL/aLR34HU31C
  • TLSH
    T1D7232B003BE8C12BF2BE4F78ADF25145867AF6672603D54E2CC441DB5623FC59A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2