Extracted

• • Target
    51728c74a608ca5adde07bc253e5ac40747d6e461a5f5edfe048eece3a3f0c2e
  • Size 45KB
  • SHA256 51728c74a608ca5adde07bc253e5ac40747d6e461a5f5edfe048eece3a3f0c2e
  • MD5 a0acb5355cadad0f150eccc2b232f8da
  • SHA1 eef77ef4794aa635c8f2a12411420347abb0ce6f
  • SHA512 12424c8ecf26f2d281af526b09a6c03842992620c07e13bbb34201e230cda6cbf39268f31ee9bca27fa69fe51be806dcbca98011fb18c47d0113e02b2a226450
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFL3hO4iLMOPI0Ozjbogn3iO9bY2EhaDQRBDZbx:4uLZZTUTn2+A/M30O3b/nSdhTdbx
  • TLSH
    T12A2319003BE9812BF1BE4F7898F26145467AF6633603D58A1CC452DB5B13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2