Extracted

• • Target
    6dccaaf0ec4ea9b5c2613b4a225fb140235c12bed454faf668e0d0d607a37f2d
  • Size 45KB
  • SHA256 4e31956b37a41715b850fd1988612279e3d6145255aa74aa3c6ca609ac1bfad0
  • MD5 143edbf1732c6bd1d9c2c772ab60e250
  • SHA1 f3b064aad66dcef30ccdf5acc54bd49ad4795e83
  • SHA512 a9599907633dc38bd119ff6bc021651beb52fba25e94d03fe20fab0f80dfe624c602d6d2a7befb87b0c4eb31d14a967b0c399221304c187a097f4970782518ee
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OFUwdrxIkDPIuzjb0gX3iMXLZghKTWBDZEx:MuBGJTPho2fqKTNMu3bbXSQgosdEx
  • TLSH
    T19B231A0037E9812BF2BE4F78A9F26145867AF6633503D64E1CC451DB5623FC68A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2