Extracted

• • Target
    f20382c2c057f7690b5eda701d0e56c6603c664b8f6a87417396ce6eabc4d769
  • Size 45KB
  • SHA256 f20382c2c057f7690b5eda701d0e56c6603c664b8f6a87417396ce6eabc4d769
  • MD5 10bab29b55b17a3f705e2363a4785bd6
  • SHA1 7ee68c774b8e2cd23d342b885bc771095b4d175f
  • SHA512 fc05dcff781be53d7679d2318179b9ff234844f6d8fa3bbef06fcdfd45336e24568beb87f04e5614f028a586ad6e7a0f0823c0e7c81d5ac4b3d8c501ec15fd97
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9zzjHy/aKPIbZjbygX3i1prdwh/G/R+9BDZ8x:0uPrpT/qY2QnhbZb1XS1UE/0Td8x
  • TLSH
    T16D231A003BE9C12BF2BF5F7899F26145467AF6633A03D6491CC4119B1613FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2