Extracted

• • Target
    6859a1fe38debf55d9abd986cce6d1da0ff06313b8bb66f54cd009e714c7c18c
  • Size 45KB
  • SHA256 6859a1fe38debf55d9abd986cce6d1da0ff06313b8bb66f54cd009e714c7c18c
  • MD5 836e03679a22a0a065f1f135e207ce41
  • SHA1 bc3dddf44c04d5e3c09c1051fd730d06bf0f7cca
  • SHA512 9799a198eb7de0d0fa26fdb273dec646b94222104781f77960b48007484e03b3f818b64314e3872e040ed175b79b25315387a6ed4f6328a72ae5383188bee1b0
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAuw0Q+KXPIVzjb9gX3iqPc7bTwZBtQzBDZcx:UuKWgSJTwRf2Q9V3bqXSfAvtOdcx
  • TLSH
    T158233B003BE9C12BF2BE5FB859F26145467AF6633603D5892CC411DB5623FC2CA426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2