Extracted

• • Target
    b51c3b1e23b148f20952291ea3dc01c61cc2a6fdec9ce531d76647bfd77e5af2
  • Size 45KB
  • SHA256 b51c3b1e23b148f20952291ea3dc01c61cc2a6fdec9ce531d76647bfd77e5af2
  • MD5 c8dc3844aa50ea4bb32f7cf618095347
  • SHA1 c98ba3d50d98b8c9a85e6057636971c32f4eac35
  • SHA512 ccf5dd9cfd3e01137a80c4d0fe0296208a18f4dad54767ceef654bb0f37d815de690e7fcedec8a522b61336d432649ed4dad0e3edfd711c3c7268d4a591f50cc
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ORzMwnOPIZzjbYgX3iDw+yFVojLHRbBDZsx:EulCJTHl42PA+3Z3bPXS8dfIRNdsx
  • TLSH
    T120231A0037E8822BF2BE4F7899F26145867AF6673603D64E1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2