Extracted

• • Target
    6d889744cf79cf3950aa8a8a97a92a66748381a8056428b81709aa4358ad3f8b
  • Size 45KB
  • SHA256 6d889744cf79cf3950aa8a8a97a92a66748381a8056428b81709aa4358ad3f8b
  • MD5 dd1a2490775c3e1419259e88536e7914
  • SHA1 f22e5da49fe669406b880a5f414fcc5904328485
  • SHA512 3c1c0ad9dd48364de61a92c501a1d94e64ec9e116113571a8fc1c9bfed1783da226397aa5d64beed45f47fbae9882c802e9a4bbc9d100c2b3d8a08c235734f9f
  • SSDEEP 768:4uBGJTP0BQ0UWUWHaimo2qVzsD/pneqPIkzjb9gX3i0I3ocXe5OmTRBBDZ4x:4uBGJTPho2QsjJeTk3bqXSZ3ocXeM8dq
  • TLSH
    T17C233A0037E9822BF2BE4FB8ADF26145467AF6733603D6492CC4419B5613FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2