Extracted

• • Target
    6ddd401e49be9cd1f2c26d3324d72d123b2eafb8d4b4effdb8973fbbf15465f0
  • Size 45KB
  • SHA256 6ddd401e49be9cd1f2c26d3324d72d123b2eafb8d4b4effdb8973fbbf15465f0
  • MD5 70e9ea41ffae415bdb254805d164677d
  • SHA1 f2d05efaf74372744d86bc5db544416bff20f655
  • SHA512 9406cffe52027e338abf38278dceb3175677ed6614b5436892386d2eb98097125dd68b99b7a7091f276a4a61c2d0bf2b7ec1763d1a054be6e85d4fc8d72842e0
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YqPq3hOPIezjbQgX3i1+h+PZGFJ+moAYhqwBDZu:EufspTf2g2Gaqq3e3bXXSkJT3lYdsx
  • TLSH
    T1AB233B0037ECC12BF2BE5F78ADF26145867AB6632603D6491CC4529B5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2