Extracted

• • Target
    e6ae65774e34deb327b422a4772c8b6e4744e1d2f558604b6c9f4c88821cd0aa
  • Size 45KB
  • SHA256 e6ae65774e34deb327b422a4772c8b6e4744e1d2f558604b6c9f4c88821cd0aa
  • MD5 00e1d0e13e049d51db9ab637ed376267
  • SHA1 088989815ca4c0012045e746fe1a8492b040c9ac
  • SHA512 ddb0cfe8eb2d81e814b0a8b34b65fceae3ff5174fdd40845194519f30205eacc6061a33b4059768b33271e5d4f4fa1acb53a6ad2109757853d228ec57d00d920
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9BHO9YjoHPICYzjb7gX3iyg3hrYlcRjDd+ABDZ8x:0u1YJTHcw2x6kgCY3bEXSQlclBd8x
  • TLSH
    T15D233C003BE8822BF27E4FB8ADF26145867AF6673603D5491CC451D75623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2