Extracted

• • Target
    c6f6345f30a9135e391fad8d10586ca14b21ff3c3d661c0513b962e3088d8a8a
  • Size 45KB
  • SHA256 c6f6345f30a9135e391fad8d10586ca14b21ff3c3d661c0513b962e3088d8a8a
  • MD5 7d51111a258204a2ad6ef1b0d40e8fe8
  • SHA1 1128ca24a21b405d8a35b3ea4da443a885c0e49f
  • SHA512 c48a44cacc1515aee17ff59b0af0100a0295660d296aff71cf8291fbc200451094654046e29637de8262bde7825723d1d82ef361e2603136036699f9d8600436
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtBz3QKx7PIQOjbpgX3iKzRoVR0GjBDZkx:suJdpTPdI2IV0QibmXSKloldkx
  • TLSH
    T1D5232A003BE88227F2BE5FB46CF26145867AF6633603DA4E2CC451DB5623BC596426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2