Extracted

• • Target
    20a0cdf919c60899d6413ad50527db0882b288c0df35b29198b215a9c80f6ae7
  • Size 45KB
  • SHA256 20a0cdf919c60899d6413ad50527db0882b288c0df35b29198b215a9c80f6ae7
  • MD5 194cf6b71c97f67f3ac9effa9c0eb753
  • SHA1 d894b2e6e52567582be73414c724fabb2d1d4fd7
  • SHA512 a0a600d6085eb4bf819e7f2e312035f0877c16361b707e71f239fde86d89b1b9dfadcd111008c8b6e9a1572072315184450aab21b6a8f74d00d423443e10fa2e
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3HE4eVoOPIGjzjbqgd3iH4VT5hUV6RBDZEx:MuLAZTnbg2BU1o3Gj3b9dSYVlOV6vdEx
  • TLSH
    T15F231A003BE8812BF2BE4B789CF26145467AF6A37603E58D1CC4519B5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2