Extracted

• • Target
    a6545cb80561ebf6ad80e29304253603fa656dfc5ad6754864f6a1077ced6031
  • Size 45KB
  • SHA256 a6545cb80561ebf6ad80e29304253603fa656dfc5ad6754864f6a1077ced6031
  • MD5 669c373ce4b661e65dd28041c2c853d8
  • SHA1 b9a57527d7bdf4516255f498c29f8a457fd1df8e
  • SHA512 f9821115c2a3c32fcd7dfbc9edf5a55e59e9616a1cab3a8de6e90e69ae1efb2203c2af8095b4240f5b65b0f21599832848a2eb633d42e1ba3531db85927bd8b8
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AozHy3CKPI2ljbCgX3ik+V0Vfd48ClGtBDZsx:EufspTf2g28rR2tblXSkzlLGudsx
  • TLSH
    T10A231A003BE9C12BF2BE4F78A9F26145857AF5633A03D5891CC411DB5B13BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2