Extracted

• • Target
    06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf
  • Size 45KB
  • SHA256 06a011a49b9ef4606f50f9010b11b46741318a4f510bc20c1422706aa29342bf
  • MD5 a1baa7ac649711e29dd0bb2f3cf0c57d
  • SHA1 604c275b39fff45acfb3cdf93e29965deb3597e0
  • SHA512 484d4650566a1652dcb4d1c1e8592482641014fd573691323a552f338fc1d0552c09eb7fe6efde7aa759fa0e50e89f448db47c06399905cd902ca4e9d350696c
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9i9oSsqHz1OPIqzjb2gd3iu6uUbfftruNlQerPBDZ8x:0uPrpT/qY2/Kti3q3bpdSuu3tafn5d8x
  • TLSH
    T173233A003BE9C12BF2BE4F78A8F26145867AF6632603D64D1CC451DB5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2