Extracted

• • Target
    51f18555ce901dddecb27fc719c61cce48e0dd64941115e6aaa6c3d12c243bc7
  • Size 45KB
  • SHA256 51f18555ce901dddecb27fc719c61cce48e0dd64941115e6aaa6c3d12c243bc7
  • MD5 2e9c88f8cb9140c15b9c06194c2c5ffa
  • SHA1 8fc5d6e9014da791b30c6762a78578835a6035a3
  • SHA512 5eece54b8304c20f58b43d349a4bff5776530820da61005eac7ef7a605804bba4c670bb6fb1babf498733643600bb75515d967dc3f6b6f4a5003f4b334ffd66e
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjTiD8yfzuOPIZzjbbgXQiyHqUwMrr6y+QBDZ8x:0u2vpTDe+24iAJ3Z3bkXtyZzrrJ+Gd8x
  • TLSH
    T158232A0037E9812BF2BF9F7499F26145867AF6A33603E54A1CC411DB5713FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2