Extracted

• • Target
    6174a19d4cce6ea3439b666a951072877595b36616255c1630f472d113fd38e6
  • Size 45KB
  • SHA256 6174a19d4cce6ea3439b666a951072877595b36616255c1630f472d113fd38e6
  • MD5 0c8957b69895f0d44eb67d209ef307a2
  • SHA1 5cd59b1bbdf7f20cddabe2c58c440add6c3a7ffe
  • SHA512 36f902e79a270a608c129a22be1393b96710770e1684df2c44614ae51b55a26afa70cca26b3e01b207a74ea139dea4853776fe82feb81d72d951ea7c8dcbed16
  • SSDEEP 768:FuxkJTVmU5EkWUGMKSmo2q1QhiQDBZwY4EdRPIBzjbygX3iHloO2gCFo4jrpBDZi:FuxkJTgip2XOY4EdOB3b1XSP7CFoO3di
  • TLSH
    T1452308003BE8822BF2BE4F789CF25245867AF1637603D5591CC4419B5B13FC69A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2