Extracted

• • Target
    660be4d2c2cf241120574d82536dbfbb06e50acb3869760d0656abff2cd316c2
  • Size 45KB
  • SHA256 660be4d2c2cf241120574d82536dbfbb06e50acb3869760d0656abff2cd316c2
  • MD5 1d14350618ca4c7d0a70ab310e524c5a
  • SHA1 32bc5db5074ef05e6207a251e6dd3422cd67203c
  • SHA512 4ec600bd9aa3369ff70ba73cdb66f3cb0f5b202881455d6a08e231794618ab1f40f683ab860b27a5a7aacdc65afa700d0a92729d6826f98437610ef82c2075e4
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA5pt0CCM+d4CvS8PIMLjbYgX3iyRiRPZzdiR8SYfa:cuqNJTLr62J/CFWBMfbPXSyRiRPdwy10
  • TLSH
    T124231A0037E8812AF6BE4F7469F26145867AF6732603D64A1CC451DB5723FC68A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2