Extracted

• • Target
    6760888131f93889b210e1f7cb53038a226734d7308b080d33db867b2b5127f4
  • Size 45KB
  • SHA256 6760888131f93889b210e1f7cb53038a226734d7308b080d33db867b2b5127f4
  • MD5 1c710c25844b7749b70072fa565a340c
  • SHA1 4a026d2ac285a3de985639f6c28f8c9b5d9589d2
  • SHA512 c74be02df17d3f51026e07a0f088994c4b2c216cbc4574dd2b952de76ccd0c8078dda295b6464cc15942d7cf9aed6dcabf663ce647e3e3b8e93058edc67608e9
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVS/qpG3jHuPIgzjbLgXyif3x9C4GIMBDZkx:suJdpTPdI2PIM3g3b0X7jC4idkx
  • TLSH
    T169233A0037E8822BF2BE4F78A9F26145467AF6637603D64D1CC441DB5623FC69A436ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2