Extracted

• • Target
    51de449d1f02725818e7458ee8631b72c06490893e6bda7f8552d747780ad538
  • Size 45KB
  • SHA256 51de449d1f02725818e7458ee8631b72c06490893e6bda7f8552d747780ad538
  • MD5 c1069316f16c26add155818fc647d609
  • SHA1 a4f8526ccff4d6f11ada4271a6b58144a831ff14
  • SHA512 da971c5534c22b72347014a8f029c1f44d45e860e7b08d1a312629b3387ca12c6b90ed32cc14c232c09713520271fb90c32403ef218d7bed79b0f4d5514719f0
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE02FjMdjYkkmPI+zjb4gX3irt+Yg43vXTBDZMx:wuZ8pT1tc2KL9wQP+3bvXSrtN/vldMx
  • TLSH
    T10A231A0037E9812BF6BE4B7869F26245467AF5732603D54E1CC441DB5A23FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2