Extracted

• • Target
    20d3a63b2b011c330a9e1deb9e01ef5b6f3bd82c35c553d870ca8fdba41ff109
  • Size 45KB
  • SHA256 20d3a63b2b011c330a9e1deb9e01ef5b6f3bd82c35c553d870ca8fdba41ff109
  • MD5 6714be45b62ec5fa1ccc6724c19edd5e
  • SHA1 7f71f2d11be2cad0f7da4454ea1478e6a5929926
  • SHA512 eddcd40d77036e5c59cc1d443845dc215cf2f206461cd76e27877b617bd0166b6735c25a711e331d10e7898df99f69ed6d436d85036ce548a069eac4ead40b7c
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPclm3API7zjbPgX3iMuF9WgHhQmBDZkx:suJdpTPdI2HfcE3l73b4XStFQgHhQodm
  • TLSH
    T126232A003BE9812BF2BF4F7898F26105467AF6637603D64D1CC4529B4623BC6DA42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2