Extracted

• • Target
    060e1ecc167804d3dad27a6bcc9462c6e55f96ee5276303b0f8bcf9875c6ded9
  • Size 45KB
  • SHA256 060e1ecc167804d3dad27a6bcc9462c6e55f96ee5276303b0f8bcf9875c6ded9
  • MD5 91f064080a02489cf925aab10633caf5
  • SHA1 8a9f23fd59ba210d8494789823a4ae2fb3e3a4e3
  • SHA512 3d3d86aadf8b267e2e4f09f555bf503b095c520b2fc55f25d18e3e538d023f9ef5b4cadf1f14058bb5f4cf8b7c2fd9eb29f43728be80f5bcbc05b815ca453290
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PILzjbFgX3ir/GdDBvER9OBDZUx:cu6YepTPso2GQL3bCXSyHvw9AdUx
  • TLSH
    T1CF232B003BE8823BF2BE4FB89CF26105867AF5636603D54D6CC452DB5623FC586426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2