Extracted

• • Target
    CorvoShield EDR Console.exe
  • Size 46KB
  • SHA256 0f776261a921e108c9fced2cce3bf5d8ce1c352976b3a0bf023eaad5d4eaf1ed
  • MD5 e295c8d71d70c7b9b33e82a30779d6fc
  • SHA1 9b1acb64c7c084a2a75cd43f93a9a78d1257585a
  • SHA512 3eecab4e36bdd7bd0bf1facb7662d202bb0a143c123ccfcafdcbfb01661397d822860f5eb86f42dfa44a2f1479255f72666a71fbc5b2b03b47e5ee8ed28a359b
  • SSDEEP 768:Qu/dcT8A03OWU8hhQmo2q9tNhsdV4WUWxPIqzJbSgX3iQzUeQQhgLmze4QBDZ3y:Qu/dcT8XG22ydiUuqFbVXSQU0gLMePdi
  • TLSH
    T17D2329003BE8812BF2BE5F78ADF251454A7AF5A73603D64D1C84429B5713FC68A427FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  corvoshield edr consoledefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1behavioral2behavioral3behavioral4