Extracted

• • Target
    a20d2fc48422446ff4ed3de17af3cefc11b84d108a19d708137aff441b4aec1d
  • Size 45KB
  • SHA256 a20d2fc48422446ff4ed3de17af3cefc11b84d108a19d708137aff441b4aec1d
  • MD5 b1df325bcbe3d3552405f30bbd97bf89
  • SHA1 b49f8e4a6c2a2a092c1bd04103e5ecb2148900b4
  • SHA512 b2e23735499bbfa263043276c5fd5a646df28dd905ca94595c718f433193cbeb5dd6ba4b6fba36ab441fefaef3458b2f8ba1e71159b4a983f0df41558b64cb0a
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ICXtTtSPIRzjbRgX3i4igYQLsoeJTXsxxKWBDZsx:EulCJTHl42fwxR3beXS4ig5jeao4dsx
  • TLSH
    T11E232A0037E8822BF2BE4B78ADF26145867AF6673603D54E1CC441DB5723BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2