Extracted

• • Target
    11f69e16808b5e7c7b6905e26c0a7665071dc46fc250b0254ba63bd9f3a67b18
  • Size 45KB
  • SHA256 11f69e16808b5e7c7b6905e26c0a7665071dc46fc250b0254ba63bd9f3a67b18
  • MD5 93eefc52a1dc0fd0fc0fc42619a56df7
  • SHA1 fc2936745b663d1d289b5fec2eca3252c75e9026
  • SHA512 27b918f048a8579cf259bbb7968213924dc05baff89bfdb12fcc2a7de8d875e60ad5e551841ca2753f96e52735e9ae0e58e4dee5001ed8ac588bd051c84ac576
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwtNd3u40cMOPI04zjbjgXYiyKCxFZCfejLknBDZMx:ku40ZTXEb278+M3043b8X1VsaejAdMx
  • TLSH
    T1AE232B003BE8812BF2BE4F78ADF26145867EF2637603D64A1CC451DB4713BC69A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2