Extracted

• • Target
    nanocore.exe
  • Size 45KB
  • SHA256 3fb3f31a4d3a167fb2e824fa3c45c40f4f3aa77b0bd8231b054bd4ace7ed2b86
  • MD5 5aab96ac6773fde94f4027228de98147
  • SHA1 5f6c941cd9da4f188169c0210415f98bb0ea17af
  • SHA512 f4de09963e9c271a1d2f9670344869ccc73713b9ada7ad0289f6a322a950d080e1c8ac5cfdca7b7a6b3c4a2d5d7f18535967d68dd616df9ede09e8b79a3e260c
  • SSDEEP 768:BuASNTR4ydbWUnrGJmo2q7qpW+VgO8tPIozjbKgX3idDJnkEOJ4xWlHBDZjx:BuASNTRZ22VRFo3bdXSdiEOcihdjx
  • TLSH
    T1BC231A003BE9827AF2BE4F789CF26105467AF6632603D94D2CC451DB5623BC6C6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  refuel-casino.cocommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2