Extracted

• • Target
    2a51878a27489bb0bc7e0ebd69047025e1f3fbff7738ea037be999b879e5a89c
  • Size 45KB
  • SHA256 2a51878a27489bb0bc7e0ebd69047025e1f3fbff7738ea037be999b879e5a89c
  • MD5 75aff063d0d5ceb580bc40ee2d7383ec
  • SHA1 98bc192a22388ebf6c5dba5cd7b02ee0ee3635b8
  • SHA512 a8299e0d0a1ad43b630a8d130634965df3aa418859e2f32b451d172abcaf29add92d2776a4bad34da77036ec76d8be077e09850e4e30f04fc4602a777bf20a89
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q17xJdxrPHuPIbzjbogZ3iSeUgDhQu/lgyBDZUx:cu6YepTPso2exR3b3b/ZSSzgDhQu/qM0
  • TLSH
    T1B9232A003BE9812BF2BE4F78A9F26145467AF2637603D6492CC441DB5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2