Extracted

• • Target
    a11b4412b8f993e985b1d2deb3ef0782eac2c25ea2cb449b87c962d9cfa86f61
  • Size 45KB
  • SHA256 a11b4412b8f993e985b1d2deb3ef0782eac2c25ea2cb449b87c962d9cfa86f61
  • MD5 b00521c0cfce07e7a78ac363dd80ae07
  • SHA1 4f68201cdbb9814888170efe4f6a163a17d11980
  • SHA512 7d3ca082d023974cfed2d7efc6a24f2e9b103e493817c2a02e28786bbb47275ee7b8669439a79e59e4c853f4a9967dd711680c2d772407974f0dbfe70f62ee53
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtBz3QKx7PIUxjbggX3i8NL1fZTtwO4BDZkx:suJdpTPdI2IV0UhbHXS8NBfp4dkx
  • TLSH
    T185232B0037E8822BF27E4F789CF26145467AF6637603D9892CC452DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2