Extracted

• • Target
    6d8cb3c19d382672071b192bac35178d12991b21850be71f1cc5e33fb8bcd33f
  • Size 45KB
  • SHA256 6d8cb3c19d382672071b192bac35178d12991b21850be71f1cc5e33fb8bcd33f
  • MD5 d6c720c75631a55c248d6b61e492cfe5
  • SHA1 d3d91f6bfa30b313dc7f3b58470b037673eb0462
  • SHA512 a517ba4fb7ff0ee2170cb87c76a5bf1a6376144b61b824fb1d8307315ad645316b944a123b8d7ea118fa35deeabb00e661e8cde1da3d227ba8f8d5e721ae02ca
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9tO5QSCBzHSNjPI7zjb6gX3ic8J/qg2XBDZ8x:0uPrpT/qY2cO59ESK73btXSc5Rd8x
  • TLSH
    T123234B003BE8812AF2BF5F7899F26141467AF6637603E54D2CC452DB4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2