Extracted

• • Target
    60dc6aad29a398927ed148f2bd474f04c681a10c935492ea616fade5d5339935
  • Size 45KB
  • SHA256 60dc6aad29a398927ed148f2bd474f04c681a10c935492ea616fade5d5339935
  • MD5 b789defc50661b28e805c7f9289361cf
  • SHA1 8ef519de504167a530684c19a839a2b68ab0842e
  • SHA512 3f3f64a4815808065121a9618182e51c58c41dbec0b6d383e224be2a9c11b94466c16499869c97c3f0d3d6d22773decb4ba424af19e487cd3a201e6b637ef0bd
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAOGsGxJOHuPIKzjbJRgQ3ialzwm6HFTIABDZcx:UuKWgSJTwRf2eeq3K3b0QSalkzF3dcx
  • TLSH
    T1EC231A003BE8812BF2BE4FB898F26145867AF5637603D64D2CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2