Extracted

• • Target
    6155b848fcf6ad47665a9db21c816339ee86f6116aa97639c9d7a4a31098594d
  • Size 45KB
  • SHA256 6155b848fcf6ad47665a9db21c816339ee86f6116aa97639c9d7a4a31098594d
  • MD5 061772e2b11afddeb991972f3e1fe173
  • SHA1 b54abe8f5c3350564f9484567f0a83219a90a39e
  • SHA512 f0fd2b800b3aeaacdab980bc61ee42e40ce4b2a9c1d759ab6c1354716789ae584ed10cf02bbb1bcf12487215f98dedc7b3cbcd78f797a9bdfe8cd2dfb665c458
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaL5P02FUFdiYkk8PIZzjb8gX3ik074QwhQEhlQkgB8:kuSOpTPOP2KLDmhBZ3bTXSky4dhQEDQi
  • TLSH
    T10F232B0037E9C12BF2BE4B746DF26245867AF6633603D6491CC441DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2