Extracted

• • Target
    51222f5b70096a4e501e5b7d8af4c3a0bf5223643b7f48e11489441d9deb9a51
  • Size 45KB
  • SHA256 51222f5b70096a4e501e5b7d8af4c3a0bf5223643b7f48e11489441d9deb9a51
  • MD5 ae3c2e39a96cf59c2996e895ae5e0121
  • SHA1 593c0f693754f5b31fa3a326c0aaaf9b31eb0949
  • SHA512 8f383ffd4343dfed9dea1f6238fbbdda3a27705058d7ae6ff040a6267f2370443e8d532a87f8bd6c662889f82a45d9eecbb59e88fc08ffbd3fb533920f6d0741
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPI8zjbFgX3iZ/8th/g76bBDZsx:EufspTf2g2v0h83bCXSZEt+eNdsx
  • TLSH
    T1BB232B003BE9C127F2BE4B78ADF26145867AF6633603D54D1CC4119B5713BC69A02AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2