Extracted

• • Target
    0e6c649e2e6a5cbb849d252c40b985d784f3396ab7113ab0e41ba571ac21a384
  • Size 45KB
  • SHA256 0e6c649e2e6a5cbb849d252c40b985d784f3396ab7113ab0e41ba571ac21a384
  • MD5 04ee2485c4944e4ca7142740b498d11a
  • SHA1 f329a1e0be645d112e5c99da327582f931cda563
  • SHA512 d13d8ba8507109bc7b1af9619433ff6aba59149fde128be65758c574a901f9d435856e6552168e032ea7f343a4e2e31080ab4c7d7f08e5721adbafe5dcf58a82
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAD0ewtDcy0oiZPIuzjbsgX3iUVKb5ZaneZrAY8BDg:cuqNJTLr62XwRPiWu3bjXS0eZrnadUx
  • TLSH
    T1D9231B003BE9812BF2BE4F7898F26245867AF6637603D5491CC451DB5613BC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2