Extracted

• • Target
    6ef069639a76209275eed295eb508a68e6a8b85aa1edd443571ed4100fc50072
  • Size 45KB
  • SHA256 6ef069639a76209275eed295eb508a68e6a8b85aa1edd443571ed4100fc50072
  • MD5 346851e0db1be163de900224eb144dde
  • SHA1 0cbc1d607a7ea66b7f8e8548b35bc486afab9f4b
  • SHA512 6c1fc134d9341578dc8e2705fd435a59a8fe08eb772f37ac8cb20eaadca463819df835963982f64d5d21906862e378abd863f0b1ff806ad1d68fa791a027d21d
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFCm/9GgrOPIRzjbCgX3i3ncpmwft4XXTTBDZUx:cu7e5TH2A2pm1b3R3blXS3cYk4XD1dUx
  • TLSH
    T150232B003BE8822BF2BE4F749DF26145467AF6A32603D58E1CC451DB5A13FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2