Extracted

• • Target
    d6a14b1996ef007f28a60b5a161719865bfb6fdfa9d5d1468ba7491a80cc11b9
  • Size 45KB
  • SHA256 d6a14b1996ef007f28a60b5a161719865bfb6fdfa9d5d1468ba7491a80cc11b9
  • MD5 6e7973b4bb4a6117f627f18b9c28b2d3
  • SHA1 a4b35217934acac47536a02f9f73360cd4709344
  • SHA512 dfd21adc47e5b216a1f8f997fedcbe8ecd0e97ecde16a6e54b41d4a522bf3a52858f31604ea661904e72e974d57efb1fa31968e0614c95db051e7d88127f0d2d
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPylF3APIFzjbzgX3iRYw4ZPOGRTLPlhjBDZcx:RuxkJTgip2Pfyv3lF3bsXS6JPOGRTblI
  • TLSH
    T1502329003BE9812BF2BE4F7898F26145867AF2677603D54A1CC442DB5723BC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2