Extracted

• • Target
    606bd964ca212648ad94f1596c387fce4943c58105daf628cd1e1fff5ffbcd9d
  • Size 45KB
  • SHA256 606bd964ca212648ad94f1596c387fce4943c58105daf628cd1e1fff5ffbcd9d
  • MD5 af7e5c8ae7f05c6588f830d9a59458d8
  • SHA1 991acb46185df5d7b93e0f0d0e535548f829ed1b
  • SHA512 054b5aec01012ebf146f6572036ed13aad4b48294c865b1de6c342e035fde68d920f68edbf7eac21b3f6e4122482f2b897a76dc3c593b78ee1c88929d3fece13
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q96iD8yfzuOPIlzjbzgXwiTI+6FteBr8G1tVdBDZTx:QuflpT8Hv2XiAJ3l3bsXNTI+g68qtVzH
  • TLSH
    T1A3233A003BE8812BF2BE5F789DF36145467AF6633603D64A1CC4519B5623FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2