Extracted

• • Target
    6b48a5326ed6230fd4a9ee128b07dc42d2aa074afe466e1bd9c6d1dd03ce6042
  • Size 45KB
  • SHA256 6b48a5326ed6230fd4a9ee128b07dc42d2aa074afe466e1bd9c6d1dd03ce6042
  • MD5 a38e05ebd9ea330f537744235660f448
  • SHA1 dca7a8d135e08f4c2a0ccf1e5a7df2aa57538363
  • SHA512 c7c7819b8c07b8aa4086013932e9a46b43ac59e1c4d7bf2e32139cc9bbcd5ee27c941b785ef4b44577c1e0d35c7d84951c34cec2cc47d99a039e6e5df97c8fc2
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9LK1YJBOPIxq7zjbqgd3i97YW0GtzOT9BDZsx:EulCJTHl42riz3xS3b9dSmKIndsx
  • TLSH
    T141232A0037D9C12AF2BE5F78A9F26145867AF6633603E54E1CC441DB4613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2