Extracted

• • Target
    e6239dea5dc65b79ec6c1d3f0d00504c67bdf4424d017055110fca84b067bc22
  • Size 45KB
  • SHA256 e6239dea5dc65b79ec6c1d3f0d00504c67bdf4424d017055110fca84b067bc22
  • MD5 150d225319210008ec7dcb0870916ab5
  • SHA1 0c6301935a81213fd9505cad9ef12aaf139b0c4e
  • SHA512 e9d9f755f7925ca9e586c778d9534e2baaae295c98d5c96d62228efcf7100f881d7a6dac23d619e6090ac8313f9f6b72e75645a376515f2a840e2517dfb76f14
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyLiE02FjMdjYkkmPIDzjb5gX3iY+UrhQmAqBDZEx:MuBGJTPho2/L9wQPD3bWXSY+UrVA0dEx
  • TLSH
    T1F9231A0037E9C12BF6BE4F7858F26145867AF6732603D6491C8451DB5B23BC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2