Extracted

• • Target
    6c64079dac9759b8236081fb183fe3d2c85e25a8b4c4efa7092107ea13e5e918
  • Size 45KB
  • SHA256 6c64079dac9759b8236081fb183fe3d2c85e25a8b4c4efa7092107ea13e5e918
  • MD5 2e84c6ed8b620629408808ace9fa09a0
  • SHA1 338def5f6978cae05f8c6dccc1571a42fe46e213
  • SHA512 d0a15ed40df9ea1fa0a6cad8bbdd4fa39e8063c6e067e80a0a686a47960c6cc694757986ebd356c3d34fb329d9cb43314b7b6117353063d92c8466baa30d7cf6
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qF1eeXKSocbbbQtN8/nPI6kzjbngX3ie7oJNvQ74BDZV:4uLZZTUTn2teH2tNKA6k3bgXSFJ18+dV
  • TLSH
    T185230B003BE8C12BF2BE4BB859F26245867AF2777603D64E1CC4519B5713FC58A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2