Extracted

• • Target
    011d9b9ae1c832fe8a2a45d80e4306279ccba09cf747a6a57c32af766c2c8843
  • Size 45KB
  • SHA256 011d9b9ae1c832fe8a2a45d80e4306279ccba09cf747a6a57c32af766c2c8843
  • MD5 5428940fea7806d2297758863d979757
  • SHA1 656d0ac34c7c2a3d843bbf095713ecc5546f9d17
  • SHA512 d0c94ca23cc5d9791a062c0b1be0812939ba2a86e348f895edda6fd45a1f601416c14be464d037188abecac4a36c0648cfc461286b91276ba7a2159570ae231b
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1K8V1QpfEcPIYzjbwgX3iGknI5BnjNZstgBDZMx:wuZ8pT1tc2x8ViBEhY3b3XS3I5hj3stp
  • TLSH
    T134232C003BE8823BF2BE4F785DF26145857AF2636603D5891CC451DB5623FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2