Extracted

• • Target
    e6bba2a6cdd60ee50ed3af8d5c2089dcd84c7364b286e4b835de5956bde87aa4
  • Size 45KB
  • SHA256 e6bba2a6cdd60ee50ed3af8d5c2089dcd84c7364b286e4b835de5956bde87aa4
  • MD5 cdb58b8390204629e152805a98799f3f
  • SHA1 511a3622485a23a7648937ac54b60c4731e5d045
  • SHA512 69269bfcbce5ce64d55c7dd1905ff76aae975e3d2f38e5d5a5468f42ee45d343f25a94b4da5a9e16a742dd9961ad0cf6ac38c258bf24eeb001d8efd2c634e59f
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjT9Y6kq/zNOPIyzjbsgn3ixLfIWSPKmdOGRqOnBDZ+:0u2vpTDe+2oa9C3y3bjnS1BSPK8qOBd+
  • TLSH
    T15B233A003BE8C12BF2BE5F78A9F26145467EB5632603D64A1CC451DB1723FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2