Extracted

• • Target
    311ee46c7be68fc09624f7f2accf244143f6b0ba8492c97badbb4916771b4714
  • Size 45KB
  • SHA256 311ee46c7be68fc09624f7f2accf244143f6b0ba8492c97badbb4916771b4714
  • MD5 c00489ba81a204f5505aa5a910b8d83b
  • SHA1 e0fdf6388b8bee08474382185aafcd0a5cd25368
  • SHA512 2eefc939925845b7d48a01ed806c9906ecc38bc3711c1b2550295decfa41974d31bb1f1b6c23edf6b79ae07138308ad0ec7cdb1b32a10b0cfe86f67de0d10007
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlyBlte40WMOPI0IzjbFgX+ijLwKPdITojWpBDZMx:wuDWZTpMZSB212UM30I3bCXHPwK7jedO
  • TLSH
    T11C232B003BE8812BF2BE4F78ACF25145867AF5636603D58A1CC452DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2