Nanocore RATMalware
- nancrat
- NanoCore
Nanocore is a Remote Access Tool used to steal credentials and to spy on cameras. It as been used for a while by numerous criminal actors as well as by nation state threat actors.From MISP Galaxy
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1059.005Visual Basic
“This file contains a Visual Basic code, which performs a Base64-encoded PowerShell command to download payload from the public file storage system hxxps://m.put.re/Qm8He5E4.exe (SHA1: 523c5e0a1c9bc6d28f08500e96319571b57e4ba7) and stores it to the temp directory under the name “av…”
What the reports say
1 report, newest first · the exact sentence from each-
Kremlin RATs from Nigeria“Its NanoCore Rat payload connects to screw-malwrhunterteams.com.”
Indicators in its reports
named in the reports above- crimea-kremlin.duckdns[.]orgin 1 report
- kremlin-afghan.duckdns[.]orgin 1 report
- kremlin-crimea.duckdns[.]orgin 1 report
- kremlin-turbo.duckdns[.]orgin 1 report
- 79.134.225[.]43in 1 report
- 95a6a416f682a9d2…01ce241b3366in 1 report
- hxxp://officeservicecorp[.]biz/rnp.txtin 1 report
- officeservicecorp[.]bizin 1 report
- office-service-tech[.]infoin 1 report
- ahjuric[.]siin 1 report
- a3816c37d0fbe26a…1ce5816039e7in 1 report
- wshsoft[.]companyin 1 report
- b42a3b8c6d53a28a…e9ca6e09cbcfin 1 report
- nitro-malwrhunterteams[.]comin 1 report
- office-data-labs[.]comin 1 report
- putin-malwrhunterteams[.]comin 1 report
- kremlin-malwrhunterteam[.]infoin 1 report
- skidware-malwrhunterteams[.]comin 1 report
- screw-malwrhunterteams[.]comin 1 report
- screw-malwrhunterteam[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.