Extracted

• • Target
    a6c634214445e237e6cb658b4ab6c1c147f3979f782ce36c2d09009c5cdbe37c
  • Size 45KB
  • SHA256 a6c634214445e237e6cb658b4ab6c1c147f3979f782ce36c2d09009c5cdbe37c
  • MD5 7fcae307c847f8b7109a879840e511c3
  • SHA1 e9469f06cd2cb676d97cb907173f2cb308ee030a
  • SHA512 bbcf449f0477d8023c8e36d47766ee5d923209e4f601d22981fd08be1abc47bfdf3b175dab5da3661f0082b7b6cc63e685e6cc05b96f86716b6b315a07eedd73
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA+FpPklON8APIDzjb1gX3ib7FpYV2Yn8wkH9gBDZe:UuKWgSJTwRf2u7kwN8lD3bSXSb7FpFY6
  • TLSH
    T1B42329003BE9C13BF2BE4B7899F22145867AF1637603DA4E1CC451DB1723FC69A426E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2