Extracted

• • Target
    6958fdcf8678e9c71e4ae1e2ffe5ccbf21e9e3eff65b453f34987eadcee642d8
  • Size 45KB
  • SHA256 6958fdcf8678e9c71e4ae1e2ffe5ccbf21e9e3eff65b453f34987eadcee642d8
  • MD5 975abd871319d542f7ff205c350d329f
  • SHA1 827e355b7ebedbdc92c7a183d8c4901daec54fb6
  • SHA512 1ea61bacb58ba84062e4f4dfe1411d9bd880fe45cc2bfa4160091a8438557229faada58f8a5501270890b5dacc60cbeab08195b79422c05c999d0d4c945e190c
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF0lrfcBEa/PItljbKgX3iMhWffUl3RganirdBDZEx:MuLAZTnbg2lJkEaYttbdXSr8BgairzdG
  • TLSH
    T1CD232C103BE9822BF2BE4F789CF26105467AF6637603D54D1CC4429B4613FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2