Extracted

• • Target
    e6c9481a7909c27d7b378cfaf3597d4a96b3a86aff3db923a8ade922c9c5dc56
  • Size 45KB
  • SHA256 e6c9481a7909c27d7b378cfaf3597d4a96b3a86aff3db923a8ade922c9c5dc56
  • MD5 5af356b545e86cb595fc6e7328cd6ccd
  • SHA1 9fc31ed79753d1aa325fd275e9ca02457573afe1
  • SHA512 c8f91d436b111a280a8da2d7bba58f4b89b183e16d37b4eb93d51e74d6abc06ccf1d178e7fe8128cf8fdb9ae376aeb94a7c25acc704371a83a854b0a4147a173
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1RpYEcPIazjb7YgX3ifxvIIXxmjAyoBDZEx:MuBGJTPho2t8VDeEha3b7XSfTXxmjA7E
  • TLSH
    T18B231A0037E8822BF2BE5F789CF26146867AF6633603D6491CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2