Extracted

• • Target
    6c246091f7b6bc788e7214cfcf0e5cdd975dc4cdf33909766df4416a52a6af01
  • Size 45KB
  • SHA256 6c246091f7b6bc788e7214cfcf0e5cdd975dc4cdf33909766df4416a52a6af01
  • MD5 64e9da83a3524ca72368a8d5eb12b279
  • SHA1 cb8b0da22fc947e8c0705da4f79bb8e022059396
  • SHA512 4e88549d6d98c33cd5839e2a83e1616b66f16f44ce3267a3593adc151b5eb4819603991ffcb1bacd8f30bc96b3f95332ba9c0fb7ccc0875c4d4f402968b81908
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2Qpm7PIKqjbBgX3iH2jf5ynUKV3FjBDZUx:cu6YepTPso2JeKmbuXSH2jf5qzVldUx
  • TLSH
    T191230A003BE8813BF2BE4FB8ACF26145857AF5632603D54D2CC452D75723BC69A526EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2