Extracted

• • Target
    60293d3def3094127e6d50660444dd480ebce7f31b088f2dcb474d42b3494c3b
  • Size 45KB
  • SHA256 60293d3def3094127e6d50660444dd480ebce7f31b088f2dcb474d42b3494c3b
  • MD5 078eda4edf1cdac1eec5f4ecd38d7805
  • SHA1 d5c89f1fecfd85e9958ff540d216ce516978d6d9
  • SHA512 b31bd8308c31bb87bebf10bac4559730038875b29cfa2bef768161046e784f3905984d3d35e9dc62d3fa6b6d01337a09b3cf88fdcf889594e1ab20e6fc36156f
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5o5TN8/nPI6EzjbUgX3iQN7ZHjGVGlK1xHaw:ku40ZTXEb2TeEoTNKA6E3b7XS+7ZDGVZ
  • TLSH
    T16E231A003BE8C12BF2BF4F7899F26145867AF6632603D55A1CC451DB5B13BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2