Extracted

• • Target
    OPFS_PaymentCore_2026_v63.1.8_x64_installer_win_prod_final.exe
  • Size 46KB
  • SHA256 b991bcf2d98bd447c5056e8682399a222ac3bdaf4f34dbca081ecd09b67b4b9f
  • MD5 ce2c075c3f6c15430713c1624702aa30
  • SHA1 4f552b4a75792724288b73b5df018b50ce444f86
  • SHA512 919cf1ca4cf3c9014e23ffd5c96b2270f75b63ccad8a48e99d25215c33ecc63b8df2ae0a0cf97fbc0f82311dbb76a3743cf3344e68f85be8b05f3547dac467e2
  • SSDEEP 768:Lue7pTjVOoYWUiMA6Omo2q4jVSbvS8OgqEqPI6zjbCgt3i9OH7YlBJKoRYghCFBQ:Lue7pTjAXY2hmS8+ET63bltS95lBgohT
  • TLSH
    T1E4232B003BE9822BF2BE5F78ACF2614546BAF6633603D54D1C84418F5613FC69A527FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  orbitpay gatewaycommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1behavioral2behavioral3behavioral4