Extracted

• • Target
    e36f69903acb104f4f6d7be659e4f9f71e55e24451db69f7a011cafb291210ce
  • Size 45KB
  • SHA256 e36f69903acb104f4f6d7be659e4f9f71e55e24451db69f7a011cafb291210ce
  • MD5 a45112485b46e7823aa68d06ad442b0e
  • SHA1 c89719383cdda1ffe844eb165ab7b34effbbe5b5
  • SHA512 04d688ee2418dbbff63dfa34f3587bc834fcadd27e91ee2a54d084244d76e13792d13b347a15ce0eff8f77d17b15e452d6d3cebf815f85225147677da518786c
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIv2jbjgX3i2IujkL1BDZEx:MuLAZTnbg2Z4EaHv6b8XSp/dEx
  • TLSH
    T165232B003BE88127F2BE4B78ADF26145867AF6A36603D58D1CC441DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2