Extracted

• • Target
    6c7206ebc767a361b6b7502ad36bd089f0d1d50f7a157f13f0109d65e4107b99
  • Size 45KB
  • SHA256 6c7206ebc767a361b6b7502ad36bd089f0d1d50f7a157f13f0109d65e4107b99
  • MD5 f887bc81a629c600489c0ae498f86385
  • SHA1 4afb86b7848e241b05ed6c4d52b1248244c35a66
  • SHA512 3bf56c5e5bb02f758f7262dcbdff47beffa70466ce90b571bfade0d2b16065ae08a04814e8e0b1787ec461a31b6d65a922419e22e48fde34d06255433d766d5d
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVS/qpG3jHuPIgzjbcgXtiiXeoOCnQfkBDZkx:suJdpTPdI2PIM3g3bzXcVoOtSdkx
  • TLSH
    T158231A003BE8812BF2BE4F7899F26105867AF6637603D6491CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2