Extracted

• • Target
    6195833096dc0506176de3a1265edf944ee0d0b69e6a9346c52869f98bde79f6
  • Size 45KB
  • SHA256 6195833096dc0506176de3a1265edf944ee0d0b69e6a9346c52869f98bde79f6
  • MD5 87185c5613f40a3fa9a8f5dada5727a6
  • SHA1 2569e2d717bf65281fd292bd848c89b5cb2beffb
  • SHA512 9ba5c9b9a1f4886ca5429977c5e6d6b75764bbc5f3c4ab2e11fddc23627f155d54cd7bb6b3ee8bb3197f8a12cc10de07aa28c14d940775b5ee2ecc5454327555
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PISzjb4gX3iJgpLZBSqxXQlc7ZS1kYB0:cu6YepTPso2GQS3bvXSJ0SqhB7s1kedW
  • TLSH
    T195231A003BE8823BF2BE4F785CF26145867AF5632603D6496CC451DB5623BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2