Extracted

• • Target
    11ae084215b892256db066f9799ac86eff34f67f7455afb640274c0f76fa91d3
  • Size 45KB
  • SHA256 11ae084215b892256db066f9799ac86eff34f67f7455afb640274c0f76fa91d3
  • MD5 8b03aeaa2d08f3fd9f6fe9b938711644
  • SHA1 c6c4ffa3a1e9650fabb956d262ed4a89e17c47b5
  • SHA512 7486759ca2c7c07ddf46de6f3e9f60e9b153eaec2212316fe3f0bea3c8a23c7736ef2aefa31ef04524c80d21db980674d5d6f60ad764d2f9b650b70fee7dd7a0
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q9qCSwTMjPIuwjbTgX3iPc9cw2UQ6ORveBDZTx:QulLJTE9X29g1u4bMXSPcOwdQbvwdTx
  • TLSH
    T1FE231B003BE8812BF2BE5F789DF26145867AF5673603D58E1CC441DB5623BC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2