Extracted

• • Target
    20686199c882f59832e7ee89d73ea2049e9ae1f25ef1460144ae46fe8244391e
  • Size 45KB
  • SHA256 20686199c882f59832e7ee89d73ea2049e9ae1f25ef1460144ae46fe8244391e
  • MD5 063cc2dfa595734c4ecb2d83c016d8a1
  • SHA1 6e1abcf7fe603de7cdcfe395f4c77918806930de
  • SHA512 a29fd2290e2e52feed41065a48026b325751ef763650b3778d08ada571bd4674230ad4f518b5c79f2751203749a2383edf4a14cc02e1ad7bfbeeb29d87e82f46
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q92CHyTtpPIczjbPgX3iOFrig9vBDZ8x:0u1YJTHcw2BnQc3b4XSM9Zd8x
  • TLSH
    T1B0232B0037E8822BF2BE4F78ACF26145867AF6673603D58D1C8451DB5723FC696426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2