Extracted

• • Target
    6b1fe3a3d5a2314627f9d7705940ae88a526b9c4806590bd05dfe64d76b86b7c
  • Size 45KB
  • SHA256 6b1fe3a3d5a2314627f9d7705940ae88a526b9c4806590bd05dfe64d76b86b7c
  • MD5 f94ecbec91430a52ca4f5619f3bdb64b
  • SHA1 3ec19753c860b3eb47f2172e113d2b5a7aff82ea
  • SHA512 7c5c48d65d3621eaac5a0a985d2937334a57add7ca9a1c3d229361ef02c8178d02250dab12fb6d8a00a746cb13203e0f1824cae63bc3d69517cdd70fb175092b
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaL5P02FUFdxYkk8PIhzjbXgX3inSt8ufKYxnBDZMx:kuSOpTPOP2KLDmWBh3bwXS2NrLdMx
  • TLSH
    T18A233A003BE9812BF2BE4F7869F26145867AF5632603D64A1CC411DB5623FC6DA436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2