Extracted

• • Target
    20b0af034b6b25be7435625ffb0a3fbdf71166a8a9ce859f075416df5073bdf1
  • Size 45KB
  • SHA256 20b0af034b6b25be7435625ffb0a3fbdf71166a8a9ce859f075416df5073bdf1
  • MD5 e2c9921e4a2e6caccebc722224de28e5
  • SHA1 98eb5dfcdef564f0da58208db7bbf9dc36fc4304
  • SHA512 583d223d78c81dcff68a930ffb0dd2f2d8c28e1c78230eec937f376797c41400a109a18983b6882afe81289d25e353fe6c37e15d3f339c17e07b170564942b4f
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjb/gX3i6k9w0kDwhP7m6:MuLAZTnbg2vSAvQZh6OAE3bIXSx9JAMF
  • TLSH
    T1AC2319003BE8C12BF2BF4FB859F26145867AF2633603D58A1CC451D75613FC69A52AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2