Extracted

• • Target
    51b4bbf20ae877996aed7d99c05d1cb2ad63f9bdea201f423117d9083a5d9f00
  • Size 45KB
  • SHA256 51b4bbf20ae877996aed7d99c05d1cb2ad63f9bdea201f423117d9083a5d9f00
  • MD5 e43e050c526315bf0b72c12910c13192
  • SHA1 e12a294ce95949b6fa9f3ed96d95f127b170ef5a
  • SHA512 fa0847b18543845b3d6d63133c9bd3e1172e2f9745bdf67228b0c3b002616a11eb3626ec743f555530331622f7105a1def0e3f53eb7ffc418c3e0fdd7af94e18
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1HqJaxjwHuPIPzjbzg83iTyQ2MInAZG5yBDZUx:cu6YepTPso2S3+3P3bs8STyvMmAZPdUx
  • TLSH
    T1DF231B003BE9812BF2BE4FB899F26145867AF2637603D6492CC441DB5623FC6D6426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2