Extracted

• • Target
    51e6610c393d903a4ef9b15cc79fe53d5f69f4d7f16b2bbee44a696bc4c08daa
  • Size 45KB
  • SHA256 51e6610c393d903a4ef9b15cc79fe53d5f69f4d7f16b2bbee44a696bc4c08daa
  • MD5 10d7da27d1a548e0daf6a8a28c4ffdb9
  • SHA1 aea3452bea40ab38f09d62eb67b074adcb93ce0f
  • SHA512 7d41bc4b70af1b30f1266d87ee1d10c270a0acee2b3707d0680a93b7d5b0f8759d3ffe74128ed668cf07949b6f3f282ab412a81bf0259aaa49fe194877570844
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFG9xY6aZOOPIrzjbMgD3iMbGoPNOc/ka9wpvBDZEx:MuLAZTnbg2Ds/O3r3bDDSMbGoF2a4ZdG
  • TLSH
    T1FF233B103BE88227F2BE4F78ACF26145867BF6636603D58E1CC4519B4613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2