NanoCore

Malware & Tools · NanoCore

· MalwareS0336 · Zararlı Yazılım

Type

malware

Techniques

Used By

4 groups

Platforms

Windows

Description

NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.(Citation: DigiTrust NanoCore Jan 2017)(Citation: Cofense NanoCore Mar 2018)(Citation: PaloAlto NanoCore Feb 2016)(Citation: Unit 42 Gorgon Group Aug 2018)

Tactic Coverage

collection (3)defense impairment (3)execution (2)command and control (2)persistence (2)discovery (1)stealth (1)credential access (1)privilege escalation (1)

Used By (4 groups)

G0064APT33HOLMIUM, Elfin G0078Gorgon Group G0043Group5 G0083SilverTerrier

Techniques (13)

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1056.001Keylogging

collectioncredential access

T1059.003Windows Command Shell

execution

T1059.005Visual Basic

execution

T1105Ingress Tool Transfer

command and control

References

https://attack.mitre.org/software/S0336 https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/https://web.archive.org/web/20240522112705/https://cofense.com/blog/nanocore-rat-resurfaced-sewers/https://www.digitrustgroup.com/nanocore-not-your-average-rat/