Extracted

• • Target
    e59e0b4e641a6d4c5f06c6ec935b5d79bc5996cae597231b53504d9bf19727e6
  • Size 45KB
  • SHA256 e59e0b4e641a6d4c5f06c6ec935b5d79bc5996cae597231b53504d9bf19727e6
  • MD5 6753d639205009b3fcbd1c69b12d904f
  • SHA1 7b34b592dfb8a4d116fab961bd37b7437a47103f
  • SHA512 1b2633e9e09f3a590029a430397092843ccdbf7670199f1ca41ea745a628c64c43455f6dccb2e47617f4cf3990e1d9a76f8a55823b29a17c20d72dd8d73f8782
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4gozHyvCKPIiljbugX3iqSVZxN/9OX1PMb6uBDZ0x:8uUIpT4vAj25L5itbRXSqmZRKkFd0x
  • TLSH
    T1F5233B003BE8C22BF2BE5F789DF26145467AF5633A03D5891CC4519B5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2