Extracted

• • Target
    e06b34eb01267b1f6b9ce0cf2732f0a4c1a4048a23293ff2ffd6512f91113bec
  • Size 45KB
  • SHA256 e06b34eb01267b1f6b9ce0cf2732f0a4c1a4048a23293ff2ffd6512f91113bec
  • MD5 2676e41998c4a85524cdcc98ce6d3051
  • SHA1 face6bd1045c5935605fe363701d7f26f3cc663f
  • SHA512 44fa87e14a7f06d865b447a14f5fe24d8b4ebcdedecfbc6e88895f5255c4b2ee18078676166049b13dc1c42dea0ce25d889cb717c083a33a45b639acce991983
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbbgX2iya8p8eygv9h3m1DBDZsx:EulCJTHl42eHIf3cz3bkX/r8iiF81Fdu
  • TLSH
    T1AA232B0037D8C12BF2BE4FB898F26145467AF6673603E58E1CC451DB5A13FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2