Nanocore

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Type
Trojan
Origin
USA
First seen
1 January, 2013
Last seen
13 July, 2020
Global rank
4
Week rank
6
Month rank
4
IOCs
7145

What is NanoCore malware?

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins that allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

This malware was recorded in the wild for the first time in 2013. Since then it has become extremely popular. It is now used in attacks all around the world. As a modular malware, the functionality of NanoCore backdoor can be greatly expanded with plugins. This makes an already dangerous RAT potentially even more destructive.

Distributed on its own website with 24/7 technical support for just $25 with all official plugins included, the malware can also be downloaded from hacking forums where its "cracked" version has been leaked multiple times, making it an extremely accessible trojan to set up and use. Unfortunately, accessibility and ease-of-use of NanoCore are still contributing to it’s growing popularity. It’s not completely certain whether the malware was being developed as a commercial program for institutions, or the creator had a goal to create malicious software from the beginning, Regardless, NanoCore author, Taylor Huddleston was tracked down and arrested by the FBI.

General description of NanoCore

NanoCore’s first beta appeared in 2013. The latest version of the malware is being openly sold on its own website NANOCORE_dot_io. Unfortunately, this helped ensure the high popularity of the malware. Today NanoCore RAT targets victims worldwide. However, the majority of attacks are taking place in the US.

One of the key characteristics of this RAT is that technically savvy attackers are able to greatly expand the functionality of the malware, fine-tuning it to suit their needs, for instance, by adding screen locker functionality to the virus. Some essential plugins are already provided with the purchase bundle on the “official” website. Other even more sophisticated ones are being developed by the community of cybercriminals, that has formed around NanoCore.

For attackers that don’t want to engage in fiddling with plugins, NanoCore provides a straightforward user interface It allows even novice attackers to launch potentially destructive malicious campaigns. Thus further contributing to the popularity of the malware.

Interactive analysis of NanoCore

A video of the execution process provided by ANY.RUN malware hunting service allows us to take a closer look at the lifecycle of the trojan. We can watch its behavior as well as all processes as they unfold in a secure online environment.

nanocore execution process graph

Figure 1: A visual graph of NanoCore execution processes generated by ANY.RUN

How does NanoCore spread?

NanoCore RAT is distributed using multiple methods. However, the most commonly used is spam email campaigns. They trick users into downloading malicious documents, often presented as price lists or purchase orders.

NanoCore execution process

NanoCore is delivered to the victim’s PC using the AutoIt program. Not unlike Agent Tesla malware, which is somewhat typical for this type of RATs. Typically, NanoCore is spread using Microsoft Word documents. Infected files contain an embedded executable file or an exploit.

Once the file is opened an embedded macros download an executable file and rename it. The downloaded file runs itself and creates a child process. The malware is able to use Regsvcs and Regasm to proxy the code execution through a trusted Windows utility.

nanocore execution process tree

Figure 2: A process tree of NanoCore execution processes generated by ANY.RUN

How to detect NanoCore using ANY.RUN?

You can identify whether you are dealing with a sample of NanoCore RAT or not by taking a look at the files created by the malware. Most often NanoCore injects into three processes RegSvcs.exe, RegAsm.exe, and MSBuild.exe.

Open "Advanced details of process" for these processes and look at "Modified files" tab in the "Events" section. If a file named "run.dat" was created by one of these processes and placed in the %Root%:\Users\username\AppData\Roaming[GUID] folder, you can be sure that the malware you are observing is, in fact, NanoCore trojan.

file created by nanocore Figure 3: File created by Nanocore

Conclusion

Thanks to accessibility, ease of use and customization, the popularity of NanoCore escalated making it one of the most widespread RATs in the world. Even though NanoCores’ creator has been arrested by officials, due to the appearance of several cracked versions, NanoCore is still openly available on hacker forums.

Often, it can be acquired for free, allowing anybody to set up attacks. The popularity of the malware is further aided by the fact that one does not need much programming knowledge to use this Trojan, as it comes equipped with a user-friendly interface. At the same time, very sophisticated and destructive attacks can be carried out with NanoCore RAT by skillful hackers, since it’s malicious capabilities can be extended with custom plugins. Thankfully, modern analysis tools such as ANY.RUN allow researchers to examine malware in detail, learn about its behavior patterns and set up appropriate cybersecurity response.

IOCs

IP addresses
192.169.69.25
79.134.225.52
193.161.193.99
185.244.30.19
185.19.85.135
3.13.191.225
52.188.119.144
194.5.97.18
3.135.90.78
3.17.117.250
3.20.98.123
3.137.63.131
18.156.13.209
3.125.102.39
3.125.102.39
3.124.142.205
3.125.223.134
194.5.98.8
213.118.237.88
194.5.98.28
Hashes
c1f0191249ee31873759df0a43e7ac82ae281ec9042175ffeacde3901b4533b0
682d0be37fa0760173f417e9bc3402596dc97a9b353d0105b274fbe766fc47c5
bf6f2a1f74f293d51a22dfc9c9d96bcb26609abaa9048e2e553ca323999e177c
4832047d5bf8f4dc4c218adeb20a4283e995d8ea641c7129ffdf0c272a9a80b6
7a6979eddd9b2fc238fd6c3c69193f056779dbc3c24c88105d7383c9964348e0
deac6ccffc19be863df0571f9e99251f47b01bc281e02258dfcec48baecf5a01
933c9cbd642a4afb977d19963a8244a5d70d596cc5e4aca7bf6866b29f11f03b
dde066d5705ea67238bce51ba3f15bb01f399c9215ff931dda9a068eab58cae7
d90d926d7d4c3ce914aadf3c5621ec5163644310f140b368880ba3f4c1251906
b49f96155708914f949bbffcfd505018e671b45f5551810dd1f72e6d81e56951
2555c6b4e0ce36a2851a552bfdea36410360e55a877ff6028458b14088062c37
9f1c428b099d37bedecc49932066548b68c34ccbc7ec2a7740b48586d5d08176
2acf6c2398a12dc97ff2ceec4f348ed6338c4aafb2dcfeb24856cf8526d12a9d
db256170f60efdebefa6673fd5e985a7688c3ea5656aa827a61b9f3c600d0b00
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
f41525eb52c0fedf1a9c72cc8893da8108e4a8e939618a0c974dfe1bfe84f9b7
9377443ab4cfef3d24370a80bf3939a393a4e4ebb4983e3949dcf74d17e9b18e
41a81d4bb83622efa3106b488e4c53bfc98368b0ed6dae03edb12c82d9351ead
35251dc6abbb122745918517caf91a5bea75f0c0ff8aff34ff5e67e67714167f
e86bdeb97763ea672b310474d0dbf98b9d2331ecf663092a1f71b32c6d36f604
Domains
54822.duckdns.org
boleto.duckdns.org
firebasecloudystemforfileexchangeonline.duckdns.org
31kungcommunicationtaristdysupliermgjky.duckdns.org
okeyboomer.duckdns.org
kremlin-crimea.duckdns.org
anaekppy9sndyinitalymedicalconsultawry.duckdns.org
10wsdyanaekppyinitalymedicalconsultapos.duckdns.org
wsdy6pksnpcoperategovernmenttgpdagentx.duckdns.org
adayznchallah.duckdns.org
crimea-kremlin.duckdns.org
netwomo.duckdns.org
tonystark2025.duckdns.org
americanfirewallsecuritysystemprotocolfi.duckdns.org
jsgjckh.duckdns.org
darckbox.duckdns.org
moeasu.duckdns.org
chnes29sndyqudusisabadassniggainthebba.duckdns.org
16dejunio2020.duckdns.org
luni.duckdns.org

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More