Extracted

• • Target
    11c7f45af62eb13109a5eaa9653aac9282869475138613a78ee3cd74777579b6
  • Size 45KB
  • SHA256 11c7f45af62eb13109a5eaa9653aac9282869475138613a78ee3cd74777579b6
  • MD5 6d3d3ed0d9f7a400313618dbf86838cb
  • SHA1 54c19e57191554f111e4abe1138a3e813f7e45ec
  • SHA512 2cf948a584241c0d9fea2884a9d46413ad8979a3e34116fd0c1a4439cc556f898bf8dcbd83f667d0c761487bf123bf60aa3164440c1e6840f5dcddcc50095a2d
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFG9xY6aZOOPIrzjbugV3iZM0pTeKILj1DssyO2jJQPm:MuLAZTnbg2Ds/O3r3bRVSZM0pT9CpDl+
  • TLSH
    T19E231A003BE8812BF2BE4F78ADF26105867AF6736603D6491CC451DB4A13FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2