Extracted

• • Target
    c6993f643c1b41b56e2efe40fc4ef65d22d06e553d6959b299b837d5a2a28a3c
  • Size 45KB
  • SHA256 c6993f643c1b41b56e2efe40fc4ef65d22d06e553d6959b299b837d5a2a28a3c
  • MD5 b3983d8239cde32dc2d11781d2ca8d5a
  • SHA1 7b18651ecaf0a16b09ef910c13959cf66ac0090b
  • SHA512 5a13a8ca97bac33990c9107a3f344eacc9a1df7fea8df3a43b896411a040f17859b8f3a3846f302c1e254bcfb0e5511f7b13f256cec81d75060cadf80d7d925c
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFH/l3u40cMOPI0azjbKgXxiGSNoh4PN6tzaF3BDZEx:MuLAZTnbg22k+M30a3bdXgHTPN6kdEx
  • TLSH
    T185231B103BE8812BF2BE4F78ACF26145467EF5736603D64A1CC452D74623BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2