Extracted

• • Target
    6674d9345c1303c9448d403065807f9de9fa8a70536223afb24b497f2e1b36d8
  • Size 45KB
  • SHA256 6674d9345c1303c9448d403065807f9de9fa8a70536223afb24b497f2e1b36d8
  • MD5 a72a002203c0a1d5b4f8b4a8d0680c0b
  • SHA1 7096327115797261469c176a2cb4c0ec12a5b559
  • SHA512 ced641d529ee16f707a48fb3c30afe52c7cd6bc68b3a9c8d5ca8167df19694dc1628e019882ca77fba9c21de461cd4e07bc55fdae660f6251be9139552e16c73
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA7Q0D3+/vPPjZPI7zjbpgw3iR7iuCB+VmosPBDZMx:kuSOpTPOP2rP32/jW73bmwScd0VA5dMx
  • TLSH
    T106232C0037E8812BF2BE4F78A9F26145867BF6633603D5491CC452DB5A13FC69A826FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2