Extracted

• • Target
    00b51071104289216e0cb9a737a08809ba1df436edb91459852cc3063ebf9941
  • Size 45KB
  • SHA256 00b51071104289216e0cb9a737a08809ba1df436edb91459852cc3063ebf9941
  • MD5 fc82d7c9dee73614276654371843c1a9
  • SHA1 3a619c078f3251812721f5c6d2b967b66ae0cdcc
  • SHA512 73765c1405a867983ae5ad7c42a3477ebdd8e99d7992c3adcba9be36f33dc7854cbfd29fd9f0a3db8b8192c73af10bef2a01aefb15015620f547256fa100b6bd
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1Q0ewUkA1MiZPI7zjbBgI3iYhwwP/Yn0chJ0mBDZUx:cuR0JTPjY2HwvDiW73buISYhwwP/g3hS
  • TLSH
    T1E2232A003BE8812BF2BE4F7899F26241867AF6637603D54A1CC451DB5613FC69A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2