Extracted

• • Target
    06e1fc069ec0e9edaa18d321322183eb3bda377c7f58b02be3dab0073532da8a
  • Size 45KB
  • SHA256 06e1fc069ec0e9edaa18d321322183eb3bda377c7f58b02be3dab0073532da8a
  • MD5 022cf6901d632846465d43a9ebfe56cc
  • SHA1 1c20430e78d3af50803012a75bb930cfd202a505
  • SHA512 1d974b69e608b3fe3d5aca56f4f9f0622f485975494859328c906ea9457c0681292b56a3afe2d8df57b27e3c4c2207c98c62a196c8d064eb2e7a975144d3ece4
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA+FpPklON8APIDzjbu8gX3ixTLMeCLScktCBDZcx:UuKWgSJTwRf2u7kwN8lD3buTXSxTLMiz
  • TLSH
    T1E4230A003BE8C13BF27E4F78A8F26145867AF2637603D64E1CC451DB5623BC69A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2