Extracted

• • Target
    06be90b357f2945e24069b3f1e466617811dcc5480102b40cc37d77a4dfdbbc9
  • Size 45KB
  • SHA256 06be90b357f2945e24069b3f1e466617811dcc5480102b40cc37d77a4dfdbbc9
  • MD5 877f82a47496b8b21647ead6bc25c246
  • SHA1 7badb144419031cc1aad1cab305965689c4aa54a
  • SHA512 5bfc5c7bc288cf1eeee2cabb23fc48c4de6ef62e5409dff53efb4b0e75341ea27690ebf8e49fd000a770ddbaffdf2e7ca0ccb6168e17d72b15944265179a190c
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q13maPol53APIkzjbngX3iylbqlzyBDZcx:RuxkJTgip22fob3lk3bgXSyl+lwdcx
  • TLSH
    T197231A003BE9812BF2BE4F7899F25205467AF6636603D6491CC442DB5623FC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2