Extracted

• • Target
    6976b7860dec8013fd2a316abed3818654808a947d1984c10a984a7dc5af855b
  • Size 45KB
  • SHA256 6976b7860dec8013fd2a316abed3818654808a947d1984c10a984a7dc5af855b
  • MD5 dd1ba491d9076a4fbabe2bfcae0e0b13
  • SHA1 93633f49ac381584a69eb222acb7c2f62414f609
  • SHA512 9e5658c3ce8b5a31b81bfd9139ca7b6867d52dbb16494191c5ee7abf4098c8c1f0b4d1abb6cc785ee2d5ed9458cbbe19e50ddb065fe6069b01f0e88ecc81ea06
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYrZo3TMtPImIjbDgX3iVTumTGtw9FwPVBtQBDZ0x:8uuSpTgyf2tU3mgbcXSVTumTMwHzd0x
  • TLSH
    T121232B003BE8812BF2BE5F78A9F26245867AF6673603D54E1CC441DB5623FC686426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2