Extracted

• • Target
    coapsdk.exe
  • Size 45KB
  • SHA256 8cc100f5244959080248bea725ff89ca3fe9b95b3b0b243c0ddec7ce078e36c6
  • MD5 5f2d35c2bb2de86b4c888cf59a83dc11
  • SHA1 397fcba0d609401710c559845573313a888e65bb
  • SHA512 94a0832f449aca88c84d9e11cbe1a014d96ef292dd836e17714cc72344c7130e2b53b6f657466db7396a85ef5bdaa9bce4e71b971f5b3403d7ac4aa105e3a499
  • SSDEEP 768:yuKR9TH4EjZWUR/ejmo2qrF9wSkq/z1OPIozjb/gu3i1SxQJRxw1PkeBGBDZ7x:yuKR9THfe26iVK3o3bIuS0WJHgPk0Id1
  • TLSH
    T1D6231A0037E9C22BF2BE5F7899F26105867AF2673603D64A2CC451DB5713BC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  admincommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2