Extracted

• • Target
    16b915a1c16dfc62263a5296d4d18512a304395dad6a68f12b44a54ece20e04f
  • Size 45KB
  • SHA256 16b915a1c16dfc62263a5296d4d18512a304395dad6a68f12b44a54ece20e04f
  • MD5 081ab5bca9ef97a6c0102dacea4db325
  • SHA1 e23f7d954fcb71730ffb27c1b7f53df17bbc83d6
  • SHA512 f8526b99563c7a4b0d6e464ff6dfe8eb29bf60a6b4ab0770c4027211057da2de7274786317fe62e72af1e22eefe02424dc5bfd130d2b1af9eb36503f8fb8af2b
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAhpt0CCM+d4CvS8PIktjbEgX3ipe22/w+0IBDZMx:kuSOpTPOP2x/CFWBklbLXS42WHhdMx
  • TLSH
    T158232A0037E9C12BF2BE4F7859F26245867AF6732603D54A1CC441DB5A23FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2