Extracted

• • Target
    11da549abd0e24de1f9a30258f07c2de4e85b95e8eb633adeb7b28098ef37d6d
  • Size 45KB
  • SHA256 11da549abd0e24de1f9a30258f07c2de4e85b95e8eb633adeb7b28098ef37d6d
  • MD5 85447b6ae19d8f2d5c207b1f2e286c62
  • SHA1 4a8511609af19807f99a4a9772df8fdd86b995cd
  • SHA512 a87cc81ba8b8833a8c0a564347409e0c23ead9d30ab0e1f471913ad281b1956dd1eda43a754ccb54b304e50cc666a01f68ab7d5a51577e2137f4d7175efb10ca
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr8uwZQaKkPIHzjbtgX3iuxhT8RU2zgZE/MBDZkx:vuogpT7I62hIH3b6XSuxh4RU20ZECdkx
  • TLSH
    T108232A003BE9813BF2BE4BB89CF26145867AF6632603D54D6CC4519B5623FC5CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2