Extracted

• • Target
    16240ed653476bf65ffa97963a9ddb27cecc7c7179eecd7a94457b40790b8544
  • Size 45KB
  • SHA256 16240ed653476bf65ffa97963a9ddb27cecc7c7179eecd7a94457b40790b8544
  • MD5 254a09317aad321f95e54c5a374b4cbd
  • SHA1 f4b5e9b37253ee30ff7ff78d3513cdb7688f16b0
  • SHA512 cf63c856b3ba82a151c016aea05e9eec7996008cb7626ce17df66bcc7f4717b5972974e5107d227ccde09beeec591c27736676423b3a8d125af2296df094a222
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1x0ewtSc30oiZPI3zjbKgX3iPHGpFc2B4zVOBDZMx:wuZ8pT1tc24ww2iW33bdXSPHyZBEVAdO
  • TLSH
    T1B1232B003BE9812BF2BE5F78A9F26245467AF2633603D5491CC451DB5623FC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2