NanoCore

NanoCore RAT, also referred to as Nancrat/NanoCore, is a commodity remote access trojan used for information theft and remote control of compromised Windows systems. The provided content states it has been in use since at least 2012–2013 and that leaked source code enabled broad criminal reuse and modification. Reported capabilities include keylogging, webcam and audio capture, spying, file execution, downloading additional binaries, registry editing, folder control, mouse control, network configuration discovery, command execution via the Windows command shell, and modification of security settings including antivirus and firewall-related controls. The malware can open a backdoor on infected hosts and is commonly used for information gathering, monitoring, and data theft.

Observed delivery vectors in the content include spearphishing emails, fake emails with attached archives such as ZIP/ZIPX/RAR, malicious documents, macro-enabled Excel files, ISO files, PDF attachments with links, OneDrive-hosted payloads, malicious software-download lures, and obfuscated VBS-based loaders that invoke PowerShell DownloadString to retrieve additional stages. NanoCore has also been delivered by other malware and loaders including GuLoader and FormBook. One analyzed infection chain used multiple obfuscated VBS stages retrieved from 52.231.98.236, culminating in a PE payload identified as the NanoCore client.

Persistence and execution behaviors described in the content include use of Windows Run registry keys and Startup-folder mechanisms, including HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and Explorer Shell Folders/User Shell Folders paths; placement of New.vbs or files under \\Public\\Run; scheduled-task persistence in some variants; duplicate loader copies; and creation of run.dat artifacts in roaming or temporary paths. Variants may use process hollowing or injection into legitimate processes such as MSBuild.exe, RegAsm.exe, vbc, cvtres, applaunch, taskmgr, or aspnet_compiler.exe, and may self-delete after installation. Communications are described as using encrypted channels with symmetric cryptography, and recent reporting in the content notes frequent use of dynamic DNS infrastructure such as duckdns, hopto, and ddns domains.

Threat-actor and campaign associations directly mentioned in the content include APT33/Elfin, Gorgon Group, Vendetta, TA2719, TA2722, Aggah, and SilverTerrier. TA2722 distributed NanoCore in phishing campaigns impersonating Philippine government and related entities, while SilverTerrier used NanoCore extensively in malware-assisted business email compromise activity and it was the most frequently seen RAT in that ecosystem in 2018. The content also notes historical use by APT33 and references targeting across sectors including shipping, logistics, manufacturing, business services, pharmaceutical, energy, finance, aerospace, defense contractors, and other organizations. Example indicators and infrastructure explicitly mentioned in the content include 52.231.98.236, wallpapercave[.]com, paste[.]ee, seeno[.]hopto[.]org, customcheats[.]ddns[.]net, december2nd[.]ddns[.]net, xp18[.]ddns[.]net, shahzad73[.]casacam[.]net, and shahzad73[.]ddns[.]net. The content also references observed NanoCore version 1.2.2.0 and notes versions 1.2.2.0 and 1.2.2.2 as commonly seen.