Extracted

• • Target
    60ef18017908dc1535accc0a204d4b365a0f7ae824d1dada145bdfd235ee8f68
  • Size 45KB
  • SHA256 60ef18017908dc1535accc0a204d4b365a0f7ae824d1dada145bdfd235ee8f68
  • MD5 306d11e41f7e76e71b04dd504a3a16d9
  • SHA1 09c65d6e08dca0cd6d009c3f3f7d9714d3ce56ca
  • SHA512 47b7a41158a3f92042251a569a541e5f49fe21c7094a2e181fa2e84f1f452bde59cc5b2651f49fb4225a6a05990e25a031c60ba901c5467d3dc1a36a2ef49be9
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE02FjMdjYkkmPIFzjbPgX3iOWzq8nsf68Elvn7:wuZ8pT1tc2KL9wQPF3b4XSdq8nM68ElD
  • TLSH
    T198232A0037EC812BF6BE4F7869F26245867AF5632603D54E1CC451DB5723BC28A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2