Extracted

• • Target
    060c017b352bfaa6002b65dab1e6199e69c968214e564b55c3fd15bed5cde243
  • Size 45KB
  • SHA256 060c017b352bfaa6002b65dab1e6199e69c968214e564b55c3fd15bed5cde243
  • MD5 cedd078940f784b2bc876ba61194f6bd
  • SHA1 0093817141100326aa60b97922dc4e4a5cad1131
  • SHA512 b445209e16c1c25ebfcf18af58d3d2de11e5a91ac21e0d5a63c927d12227d58033f2b7ed5c865c81f3598b5ea3cba7e78cb450ac2af82e3e94f77bfa720101db
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtO6R8aI3OPIOzjbtgg3ibgWejwYRBDZ0x:5udApTNmU2h+FO3O3b6gSEdd0x
  • TLSH
    T128232B003BE8812BF2BE4F7898F26145467AF6673A03D58A1CC451DB4613FC6DA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2