Extracted

• • Target
    sexgayga.exe
  • Size 47KB
  • SHA256 6ad8a264acc4922925bbc8f1c5b8587f956f6eda08efd03945d246202e1121c8
  • MD5 457ce6df657dd28b0efccd1d63a3f45f
  • SHA1 650f734d4043174bdcaef97fd8ff3edb7c8daca8
  • SHA512 d577df214f90c52802a58f730d81ba43cf0e7e615fbfd6d216c652cf589d33571aa6931c2178621fa2e3e29c2fedf11c10a4e9ed3730b58fea3806f3a888c0e8
  • SSDEEP 768:4uRRJTsUVIEWUmBDymo2q1xV0aRqa/uzXghdxOIEQ9PI7MNru0b8YoeBkaTkvgnw:4uRRJTs2P2Epqa/uzXghdxxEJ7Mbb8YE
  • TLSH
    T11A232B003BE9C12BF27E4F78A8F22245857AF2677603E54D2CC451D75A13FC29A525EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2