Extracted

• • Target
    6d5dfbbb6f771f0418e1f79b345dd1a4ca21ba7e67c8875bf3e01b77ebfb8d6b
  • Size 45KB
  • SHA256 6d5dfbbb6f771f0418e1f79b345dd1a4ca21ba7e67c8875bf3e01b77ebfb8d6b
  • MD5 53e435f523bf9e60a31e549dacfe18ce
  • SHA1 148cac7022cddddbedcf30289f6b8753fd55a5cf
  • SHA512 757b087e71efdd885aa900c0b2c8b2caed21d6e374ce435769ba2c0e01bfeaf4792436a64cddbf89946d14640a40d3e79f2eb6d17600514e085cda194ea85a01
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9e/cYssPJZOPIcvzjbxgXKiA60iPHOoh4GYrKvBDZ+:0u1YJTHcw2RMIf3cv3b+XzA6VXh4GMKm
  • TLSH
    T123233B003BE8822BF1BE4F7899F26145867AF6673602D58E1CC441DB5623FC6CA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2