Extracted

• • Target
    ab51a68721f77e758c13f7e0741eaa9ed18bf1b545f4758a4fb7b4be41627640
  • Size 45KB
  • SHA256 ab51a68721f77e758c13f7e0741eaa9ed18bf1b545f4758a4fb7b4be41627640
  • MD5 6d2a7e09aa1cb08afe613b5c9f3e7d17
  • SHA1 42eb3bc15c34fff90e3eb4341529191d393951ce
  • SHA512 d26e0b93be26f6eb878f910f64860e9013d3813526cd96f367fb3cd872733da0394c2b5a50f6aa0d1df22c4f403f0d57430ea94c849bb4a5b5211898f857645f
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXT9Qpm9PIXzjbpgX3iiyr9mxlSGBDZkx:vuogpT7I62AQX3bmXSiSUxlSIdkx
  • TLSH
    T17F2319003BE8813BF2BE4FB89DF26145467AF5732603D54D6CC451DB5A23BC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2