Extracted

• • Target
    6a08b173927674d7fcb25040cab99ec0566701950bef0378e7702f6447a1df79
  • Size 45KB
  • SHA256 6a08b173927674d7fcb25040cab99ec0566701950bef0378e7702f6447a1df79
  • MD5 110dcc4bc19ba6d0961949c2fbc65549
  • SHA1 1f7fb5823ef8b2418cabc8a8954dc02399a746c0
  • SHA512 c42e5d4790fd4e2822b849e40c74301784fa779317e760a7da456a67bea5bd15b8f30b5493b20b8d8502ee7d0fca47b4ff28e08a572d830816e99d409069cb4f
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAW0ewtSc30oiZPI3zjbygX3iYJGQl6Gr/m+T3BDZMx:kuSOpTPOP24ww2iW33b1XSYJGm6Q/m+i
  • TLSH
    T1D3232B0037E8813BF2BE4F7869F26245867AF6733603D5491C8451DB5723BC69A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2