Extracted

• • Target
    60c11bbc61a84fe4e30395ec97122c6112327bdf80d20884bb18043ba40a8727
  • Size 45KB
  • SHA256 60c11bbc61a84fe4e30395ec97122c6112327bdf80d20884bb18043ba40a8727
  • MD5 f4915809b417416eb69b20205409ac46
  • SHA1 74ac09c282608a7c1e1bd4cc68c1813b45c59616
  • SHA512 823567b8f9ba0447fdde72f91a089d6686b3b8efc74864fee561647678d77cd25c5a2b4ade65b5b756490cd21f87a06c3924c65745c30f6e7bcde41f9a539961
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1TgzZUpx7PI8NjbygX3i+4hdKXM5UBDZUx:cu6YepTPso2Con8Fb1XSvgM5idUx
  • TLSH
    T172232B003BD8C23BF2BE4FB898F26145867AF5633603D5492CC451DB5623BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2