Extracted

• • Target
    6b338144db7f74ebf09e048e0bb15dec8c1a74ca31715dc3995d788156cfbedd
  • Size 45KB
  • SHA256 6b338144db7f74ebf09e048e0bb15dec8c1a74ca31715dc3995d788156cfbedd
  • MD5 fc292a0571c1b84899d2e16f247befc1
  • SHA1 62093a8d78427cb085c31d8d6aabf0ccf8453cf4
  • SHA512 01aba5ee3adbe02d4c9499b96f6e76d06a66e38071503786622ccd8ba9520f23fee9581330df8e1e8c00707ed50219798d4a003aef4ddada9c366a3aff5b368a
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjLqz8yfzuOPI9zjbVgXKiWgk3cuJaSk6LhqBDZ8x:0u2vpTDe+2gqQJ393byXzC3LaS3id8x
  • TLSH
    T1B4232B003BE8C12BF2BF4F789DF26145867AF6632603D64A1CC4529B5613FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2