Extracted

• • Target
    e16bcd777464da62effac968cf877e012626f62c5e204e065d910aaf04a05904
  • Size 45KB
  • SHA256 e16bcd777464da62effac968cf877e012626f62c5e204e065d910aaf04a05904
  • MD5 08759bb8ef0337a137cdba011701e6ca
  • SHA1 2263b29520003d8b30a9b833754f0b7b25d0f9b7
  • SHA512 f5a6301e9d58c7c50e429d67022e4df4d2f50c0f983c958fcc5b6cafe8163ea93b82962e234ec231d5ee44c1faae091eac79362537b029042d409c7d98d7b3c7
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFo3xY6AZOOPILzjbagB3ihvY47T9rvFbBDZEx:MuLAZTnbg2RulO3L3bNBShvY6TNdEx
  • TLSH
    T1EE233A003BE8822BF2BE8F78ACF26145867AF6637603D5491CC451DB5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2