top title background image
flash

3e18bdf74f3caef770a7edcf748bdaf0e6a4a21664e69.exe

Status: finished
Submission Time: 2025-01-07 17:11:10 +01:00
Malicious
Trojan
Spyware
Exploiter
Evader
AsyncRAT, GhostRat

Comments

Tags

  • AsyncRAT
  • exe
  • RAT

Details

  • Analysis ID:
    1585454
  • API (Web) ID:
    1585454
  • Analysis Started:
    2025-01-07 17:11:11 +01:00
  • Analysis Finished:
    2025-01-07 17:21:15 +01:00
  • MD5:
    46441da6848047284fdd6a2dfa19b802
  • SHA1:
    bbafc91be5b5c0a1248aac8e485aea1a7a4fa03c
  • SHA256:
    3e18bdf74f3caef770a7edcf748bdaf0e6a4a21664e69bf765371529aa07db9f
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 22/38
malicious

IPs

IP Country Detection
157.20.182.16
unknown

Domains

Name IP Detection
jojo.ath.cx
157.20.182.16
bg.microsoft.map.fastly.net
199.232.214.172
s-part-0017.t-0009.t-msedge.net
13.107.246.45
Click to see the 1 hidden entries
fp2e7a.wpc.phicdn.net
192.229.221.95

URLs

Name Detection
jojo.ath.cx
https://github.com/mgravell/protobuf-net
https://github.com/mgravell/protobuf-neti
Click to see the 5 hidden entries
https://stackoverflow.com/q/14436606/23354
https://github.com/mgravell/protobuf-netJ
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://stackoverflow.com/q/11564914/23354;
https://stackoverflow.com/q/2152978/23354

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\smcdll.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\smcdll.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smcdll.vbs
ASCII text, with no line terminators
#