Extracted

• • Target
    16ac1734b76b01af84a29a87ed60f956305e3067db70ad1884a917b5dcaf1971
  • Size 45KB
  • SHA256 16ac1734b76b01af84a29a87ed60f956305e3067db70ad1884a917b5dcaf1971
  • MD5 039c938e93082744156f3d879e82b226
  • SHA1 391e9ff15cd01f80d19d8444aa5c4a54a1bb792a
  • SHA512 a8bed967a4eeacd52771b23007e92a37f3406f69cc0a9ed80dc77f25e850d9e829453fa1f694472653ae83e651d2b411068da6e3d6fc2d825103113eee0a5434
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwy+eXIco15l8NnPI6LzjbZgX3rzLAmhDXuVUwTBDZO:ku40ZTXEb2/enU5l4A6L3b2X7zLAmEL8
  • TLSH
    T17C232A003BE8C22BF2BF4F7859F26145867AF2633603D54A1CC451DB5613BC69A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2