Extracted

• • Target
    b6cb89887d8022bd538c6bf4537ac367e1a5ffd43604d56e9640edc1c691b2e0
  • Size 45KB
  • SHA256 b6cb89887d8022bd538c6bf4537ac367e1a5ffd43604d56e9640edc1c691b2e0
  • MD5 8bbd24401f34c3ac456625e579b018b9
  • SHA1 a1449f89abb9e3d115b9b7df42faf9969b536bc9
  • SHA512 3b76c095ab69b00c3f83e233d53bf68956e23c7ffa721ecf80def7ec9a465bf5c85307fff57c09be39b818bdeb8ea14efe3e8e9b7a439d73bec10b3323a124aa
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97iD8yfzuOPIlzjbugXxi9cSBDZsx:EufspTf2g22iAJ3l3bRXgasdsx
  • TLSH
    T1CF232B003BE8812BF2BF4F7898F26145467AF6637603D6891CC451DB5B13BC69A826FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2