Extracted

• • Target
    6d76eb60081181c8949627bf602841f59d400094307c49030a48be226a9be6b3
  • Size 45KB
  • SHA256 6d76eb60081181c8949627bf602841f59d400094307c49030a48be226a9be6b3
  • MD5 8fe65623b3e8d0ed749468f264009fb1
  • SHA1 d174d61accccb508268ba0477015e3e0feb0f669
  • SHA512 b6e4acea315c47e495cfd5fd02a237b9331e09f2030ed2fa70a14e11dfdc44a6f0030fd4dad0366bbe2d9b0733c9f1cb15d0c0232b1b9818fd3433371be69155
  • SSDEEP 768:Iu5KkpTsU6Q8WU+xjamo2q1zbT0GYjHuPIpzjb7gXOijtNAZF6t+jBDZLx:Iu5KkpTsx/2Ws/3p3bEX3BNbtsdLx
  • TLSH
    T11D233A003BE9822BF2BE5FB868F26145857AF2633603D6491CC441DB5723BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2