Extracted

• • Target
    60e3cf4e174f27392576ad93cd2b20375742e2edd55ee5a8fa01d2a94036c077
  • Size 45KB
  • SHA256 60e3cf4e174f27392576ad93cd2b20375742e2edd55ee5a8fa01d2a94036c077
  • MD5 b419a7846cf82b844f7da01150b41377
  • SHA1 7db3322be71c8164b8cb8c44b9996935f1a32980
  • SHA512 ae91c7f92b6602a52f1f342e7ca936801be7734d4e5aaaa604c9c5c18527d37543690b3921274ac04cdcbf4f17767a43d46342371b4b0413ef657fa9ce02472d
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q9u/rLzlJAOPIc6zjbvgX4id4UbNllk99PBDZTx:QulLJTE9X2BPp23c63bYXVd4UHlgdTx
  • TLSH
    T1B9231B003BE8822BF2BF4B78A9F25145867EF2673603D64A1CC451DB5713FC69642AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2