Extracted

• • Target
    a6e9a60428a8d53a9fe327bdcc11941cbaaa2a7406373685abfa125e076b248e
  • Size 45KB
  • SHA256 a6e9a60428a8d53a9fe327bdcc11941cbaaa2a7406373685abfa125e076b248e
  • MD5 3100bbdab534a89d01b176d001cdcda7
  • SHA1 e3760b1dfda87178cf589a804fb9c4520b7f5e1a
  • SHA512 1497b51a38349bc72fd4f5de0ae2f64ca5d5203426b866a4b8c19f669c7b07f0267e18611852d5e6af85d65b8439243eb3336ea017487e021f5b058a937d521e
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozfy3CKPI0DjbcgX3ij/QcMoFuBDZ0x:8uUIpT4vAj25TR0nbzXSj/QcMqgd0x
  • TLSH
    T18F231A003BE9C12BF2BE4F789DF26145867AF6633603D6891CC4519B5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2