Extracted

• • Target
    51606e9349f1700ccd3f8caa51aab40a7ece4b9f6cffb210d32b92e5b383d227
  • Size 45KB
  • SHA256 51606e9349f1700ccd3f8caa51aab40a7ece4b9f6cffb210d32b92e5b383d227
  • MD5 9a4fdf48253e7f61b5c084a1ee2690eb
  • SHA1 3d1ed23bdf825389f1e3864a304e8bd3cdf124c6
  • SHA512 53622e04fd162f4674c9dae4bcb80a01d05894162fcd09b721400e5e76b20970b2257fd97b44182610762725cbb1afb8b5198447014e76e5258ccf6bd1f088dd
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4UITnyXaaPIAzjbWgX3i6Aku0F4Y/OG7BDZ0x:8uUIpT4vAj2wEZA3bJXS6AkDFN/OGtd2
  • TLSH
    T115232B003BE9C12BF2BE4F789DF26145867AF5632603D68D1CC4519B1723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2