NanoCore

NanoCore is a notorious Remote Access Trojan (RAT) first discovered in 2013. It targets Windows operating system users and operates by opening a backdoor on an infected computer to steal information. NanoCore has maintained a top five position for six consecutive months, taking the third spot in December. It's worth noting that it was among the most prevalent malwares last month, with a global impact of 1%, following FakeUpdates and Formbook which impacted 2% of worldwide organizations. In a recent attack scenario, NanoCore was deployed alongside Remcos by GuLoader. The malware downloaded encoded data from the “nanoshield.pro/files” URL, reversed the data, replaced the specific string “DgTre,” and employed “RegAsm” to proxy the execution of NanoCore. Additionally, the plugin files downloaded from the C2 server included VenomRAT version 6, Remcos, XWorm, NanoCore, and a stealer designed for specific crypto wallets. In December, the BunnyLoader payload was delivered as a follow-up payload to a NanoCore infection using a novel .NET injector. The final payload was a dropper Trojan known as Win.Dropper.Nanocore-10011208-0 Dropper Nanocore, a .NET remote access trojan that installs the NanoCore RAT. This demonstrates the complex and multi-stage nature of attacks involving NanoCore, highlighting its persistent threat in the cybersecurity landscape.