Extracted

• • Target
    6d3cabd895c57a82c7ece696ab28535023d6ef355500ecc950b6ac0ca1d105d8
  • Size 45KB
  • SHA256 6d3cabd895c57a82c7ece696ab28535023d6ef355500ecc950b6ac0ca1d105d8
  • MD5 6981880c98e0a7fb1c4d9a5fcf3392fa
  • SHA1 98f8c0f2ef64acd9b90af076cc600793df98ee3a
  • SHA512 2b7bc907c7fb0382728284aeb114029e0f140fd96fd680a510e9856cf6f54a7a2bfac57438c783419e20608dccf7e11407ce1363ef4c00b5c87842c83f997245
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5o5TN8/nPI6EzjbkgX3ig8pezZmcdSN96bB8:ku40ZTXEb2TeEoTNKA6E3brXSKUNCdMx
  • TLSH
    T178232B003BE8812BF2BF4FB899F26145867EF1632603D94A1CC451DB5713BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2