Extracted

• • Target
    ee8fc54eddbb14feea158364b1a1be030b299501a18f6b929240de8eb87d0d0c
  • Size 45KB
  • SHA256 ee8fc54eddbb14feea158364b1a1be030b299501a18f6b929240de8eb87d0d0c
  • MD5 e1ac6c0115ef692fb72674b50e195ca4
  • SHA1 4c34b03c1327c476bbe4686f43e4fe6cb45f2ae1
  • SHA512 1c31a272b94ba20c7f67bb0558a0f3f015fe6f6c377807e4f2b853b34d26aab766573ff034fb5631dc1a62f302b087468a491532d536e3c43be1663082c763c6
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97S7synzuOPIzzjb1gXKilhzrgHaOpTVeoS4BDZsx:EufspTf2g22SYh3z3bSXzlh4b/3dsx
  • TLSH
    T1F9232A0037E8822BF2BF5F7899F26145867AF2637603E6491CC451DB4613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2