Extracted

• • Target
    11d37c95ff418d75986e17395217b2e7a2b202dc37be0b73105b04d61d917040
  • Size 45KB
  • SHA256 11d37c95ff418d75986e17395217b2e7a2b202dc37be0b73105b04d61d917040
  • MD5 0592f8307d83912fe9a351495201e813
  • SHA1 4e1ec3afb2b90521816f61e19e4f98aae4ffb4db
  • SHA512 0c77fd15f0c5543938e8bec0ed9f45f6b600b4535eaaaa44d84520cbd9a7d9e352a73105b855409d89dcf008d1fbd4588476069790391dfb2829cb5395e1fe4e
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qV/AP0py4mHPI/zjb3gX3iMvx+CJrmscrbgohwSsBDw:MuBGJTPho2kAcM4mg/3bQXSM5LJ6s4bB
  • TLSH
    T1F1231A0037E8823BF2BE4F78ACF26145867AF6672603D6492CC451DB5623FC686526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2