Extracted

• • Target
    600ea31a518ee6e99e3c565172f6360ee7ef6a7b1f2c3edb7f8de04a95a144a3
  • Size 45KB
  • SHA256 600ea31a518ee6e99e3c565172f6360ee7ef6a7b1f2c3edb7f8de04a95a144a3
  • MD5 563e8c41a4a0dc0cf534f49214a2a076
  • SHA1 c67195ed26c19acb880c27a57504302fcb289df0
  • SHA512 db87b9a49c6a904a027fdbe95c65ca04b09788bb9420ff78fd1b716d8ebe06b4f0b3fabe098ccfd59f4e4c80bc778ce89aeb756f79ed391eb0b26000e874a105
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9LqTkafz+OPIEzjb5gXUideUBOMBL7wdJwv86BDZsx:EufspTf2g22qoR3E3bWXxd8MR2+vndsx
  • TLSH
    T1D8232A003BE9812BF2BE4F7899F26145467EF2636503DA4A1CC451DB5713FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2