Loading malware…
NanoCore RAT, also referred to as Nancrat/NanoCore, is a commodity remote access trojan used for information theft and remote control of compromised Windows systems. The provided content states it has been in use since at least 2012–2013 and that leaked source code enabled broad criminal reuse and modification. Reported capabilities include keylogging, webcam and audio capture, spying, file execution, downloading additional binaries, registry editing, folder control, mouse control, network configuration discovery, command execution via the Windows command shell, and modification of security settings including antivirus and firewall-related controls. The malware can open a backdoor on infected hosts and is commonly used for information gathering, monitoring, and data theft.
Observed delivery vectors in the content include spearphishing emails, fake emails with attached archives such as ZIP/ZIPX/RAR, malicious documents, macro-enabled Excel files, ISO files, PDF attachments with links, OneDrive-hosted payloads, malicious software-download lures, and obfuscated VBS-based loaders that invoke PowerShell DownloadString to retrieve additional stages. NanoCore has also been delivered by other malware and loaders including GuLoader and FormBook. One analyzed infection chain used multiple obfuscated VBS stages retrieved from 52.231.98.236, culminating in a PE payload identified as the NanoCore client.
Persistence and execution behaviors described in the content include use of Windows Run registry keys and Startup-folder mechanisms, including HKCU\Software\Microsoft\Windows\CurrentVersion\Run and Explorer Shell Folders/User Shell Folders paths; placement of New.vbs or files under \Public\Run; scheduled-task persistence in some variants; duplicate loader copies; and creation of run.dat artifacts in roaming or temporary paths. Variants may use process hollowing or injection into legitimate processes such as MSBuild.exe, RegAsm.exe, vbc, cvtres, applaunch, taskmgr, or aspnet_compiler.exe, and may self-delete after installation. Communications are described as using encrypted channels with symmetric cryptography, and recent reporting in the content notes frequent use of dynamic DNS infrastructure such as duckdns, hopto, and ddns domains.
Threat-actor and campaign associations directly mentioned in the content include APT33/Elfin, Gorgon Group, Vendetta, TA2719, TA2722, Aggah, and SilverTerrier. TA2722 distributed NanoCore in phishing campaigns impersonating Philippine government and related entities, while SilverTerrier used NanoCore extensively in malware-assisted business email compromise activity and it was the most frequently seen RAT in that ecosystem in 2018. The content also notes historical use by APT33 and references targeting across sectors including shipping, logistics, manufacturing, business services, pharmaceutical, energy, finance, aerospace, defense contractors, and other organizations. Example indicators and infrastructure explicitly mentioned in the content include 52.231.98.236, wallpapercave[.]com, paste[.]ee, seeno[.]hopto[.]org, customcheats[.]ddns[.]net, december2nd[.]ddns[.]net, xp18[.]ddns[.]net, shahzad73[.]casacam[.]net, and shahzad73[.]ddns[.]net. The content also references observed NanoCore version 1.2.2.0 and notes versions 1.2.2.0 and 1.2.2.2 as commonly seen.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"The malware downloaded and executed by the .Net downloader is NanoCore, a well-known RAT (Remote Access Trojan) that enables the remote monitoring of victims via their computers."
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Overview NanoCore is a RAT (Remote Admin Tool) used by cybercriminal groups such as APT33... The main potential of NanoCore is usually to steal data from the computer and user once it has gained access to the disk, but once it is inside, it could perform any action from the outside... we get the NanoCore client...
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
NanoCore (also known as Nancrat) is considered a RAT (Remote Admin Tool), which is used to obtain relevant information from victims such as data from the affected computer, camera captures, keyboard input, etc.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
it has been most commonly used through fake emails with .zipx extensions or with fake formats, which is commonly called phishing (T1566)
it has been most commonly used through fake emails with .zipx extensions or with fake formats, which is commonly called phishing (T1566) or in this case, since it contains a file in the email and its objective is execution on disk to go further, it would be more accurate to call it Spearphishing (T1566.001).
[TA0003][T1053] Persistence on tasks using tmp dropped file (Command) schtasks.exe*/create /f /tn*Host*/xml*AppData*.tmp*
we find an IP [ 52[.]231.98[.]236 ] to which it will make a download request using “ DownloadString “, as expected, using powershell and after this, it will execute the content that downloads
we often see similar execution patterns where the main binary spawns a copy of itself and executes various commands using cmd.
Contagious Interview has established persistence using InvisibleFerret malware to place a .bat file in the Startup Folder. TeamTNT has added batch scripts to the startup folder. Storm-1811 has created Windows Registry Run keys that execute various batch scripts to establish persistence on victim devices.
[TA0003][T1053] Persistence on tasks using tmp dropped file (Command) schtasks.exe*/create /f /tn*Host*/xml*AppData*.tmp*
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Examples include AppleSeed using HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce, AvosLocker executed via the RunOnce Registry key, NanoCore creating a RunOnce key, and the content listing HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce and RunOnceEx paths. | Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
Contagious Interview has established persistence using InvisibleFerret malware to place a .bat file in the Startup Folder. TeamTNT has added batch scripts to the startup folder. Storm-1811 has created Windows Registry Run keys that execute various batch scripts to establish persistence on victim devices.
[TA0003][T1053] Persistence on tasks using tmp dropped file (Command) schtasks.exe*/create /f /tn*Host*/xml*AppData*.tmp*
it is usual in this type of RAT to inject the code (or perform process hollowing) of the final binary in a legitimate software
it is usual in this type of RAT to inject the code (or perform process hollowing) of the final binary in a legitimate software
Examples include AppleSeed using HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce, AvosLocker executed via the RunOnce Registry key, NanoCore creating a RunOnce key, and the content listing HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce and RunOnceEx paths. | Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
which, as usual in this type of loaders, hides another obfuscated script creating script chains so that the analysts lose interest or increase the difficulty of the analysis
it is usual in this type of RAT to inject the code (or perform process hollowing) of the final binary in a legitimate software
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
It has different capabilities such as downloading, establishing connections, controlling registries and folders, acting as a keylogger
Proofpoint named the first identified cluster Shahzad73 based on the command and control (C2) domains used by the threat actor... The observed Remcos samples included the following example configuration: C2: shahzad73[.]casacam[.]net:2404... Observed NanoCore RAT samples included... PrimaryConnectionHost: shahzad73[.]casacam[.]net
it will make a download request using “ DownloadString “, as expected, using powershell and after this, it will execute the content that downloads
113 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan associated here with process injection, keylogging-related calls, and command-and-control traffic.
Windows remote access trojan delivered via malicious PowerPoint (PPSX) droppers and a .NET downloader; provides remote monitoring/control and is obfuscated via packing/crypting (PAC Crypt). C2 observed at 88.198.222[.]163:8081.
Commercially available RAT with keylogging, screen capture, password theft, data exfiltration, downloader, and persistence capabilities. Spread via malspam attachments.
Remote access trojan payload delivered by the analyzed obfuscated .vbs loader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.