Extracted

• • Target
    11a0cf24b4c88d32f446b25a293446cdbeb156ee8a977e020a73bea059408454
  • Size 45KB
  • SHA256 11a0cf24b4c88d32f446b25a293446cdbeb156ee8a977e020a73bea059408454
  • MD5 22e4a8ab91e29f5db8e630a504f9e420
  • SHA1 a67b76ee65df9e0659bf4d351d482980d9512925
  • SHA512 2fdbb532fb23ee95e44c009cf4c77cf1702997d84a12a223e61bc0bef8e5cf07b5d904f79f80c682d93825de2678d2e16ad98e0799c2fc18db666a4b43ca16ba
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZoyTM4PIXpjbUgX3i2S7SEoBU9BDZ8x:0u1YJTHcw2dh0XJb7XSB1ld8x
  • TLSH
    T175230A0037D8822BF2BE4F78ADF26145867AF5677603D58E2C8441DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2