Extracted

• • Target
    c6ee2eac43d5560be2388510efaafb1e962ccc67d26767d460a2396fbb806316
  • Size 45KB
  • SHA256 c6ee2eac43d5560be2388510efaafb1e962ccc67d26767d460a2396fbb806316
  • MD5 69757d7550c83621ba4ed44740897d69
  • SHA1 c8cd15c4c93fb398f46da9a9b7b49b28b0f48ad5
  • SHA512 3473ed09bcce6a73e9387d40615977ff6b7352c46fc2be93d26f524b4aedbd97c4e7b39291a34f2f9791c19c23e80b400909432be41e80860538bfa5c4217e9a
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11Bz3QKx7PIUjjbWgX3iXEMTg9Fu8136IBDZcx:RuxkJTgip2AV0UHbJXS7U9Fu813Vdcx
  • TLSH
    T177232A003BE8C23BF2BE5F7898F26145467AF6632603D5492CC452DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2