Extracted

• • Target
    a51c9e6ceeb571b7acfe4d9361176c45d9dd378cfbdff3078c263303646cf82a
  • Size 45KB
  • SHA256 a51c9e6ceeb571b7acfe4d9361176c45d9dd378cfbdff3078c263303646cf82a
  • MD5 6eb62752f983eaf095ee4707912fe9f2
  • SHA1 cdf5ce25443d576eeafceddde56f2c1af2c61b2e
  • SHA512 fc06f0a9bfbb8f461193dec97b47d7e2f6e0ad364247a868d2b37e957f03198413f0d35fb4d2c76be1bd4641cf0f46798e0da0f989b46c0797b8d730e1010481
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFB3XoPEayPItzjbBgX3iWX4+Llt6BDZEx:MuLAZTnbg2umEabt3buXSWX4mlqdEx
  • TLSH
    T192232A003BE9822BF27E4F78ACF26145867AF5636603D54E2CC4419B5713FC69A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2