Backdoor:W32/Nanocore

Infection Vector

This threat is the payload of a multi-stage trojan-downloader, which usually arrives as a document file attached to email messages sent out as part of a spam email campaign.

Behavior

This RAT is used for surveillance and data exfiltration.

It remains persistent in the system by installing the Run registry and Scheduled tasks to execute itself during startup.

Autorun Keys:

• Name: "SAAS Monitor"
• Data: "c:\program files\saas monitor\saasmon.exe"

Scheduled Tasked:

• \SAAS Monitor <%Malware Path%>
• Example: \SAAS Monitor Task c:\program files\saas monitor\saasmon.exe

To protect its process, the RAT throws an exception which will cause the system to crash when its process is terminated.

This threat establishes a connection to a remote command-and-control (C&C) server and executes the command(s) issued by the C&C server.It provides the following details to the C&C server:

System information

• Current active window
• CPU Usage
• RAM Usage
• PING
• Client country
• Workstation name
• Idle time
• OS
• OS bit
• Access rights
• Anti-Virus application
• Anti-Spyware application
• Firewall application

This threat is capable to execute these function on the infected system when connected to the C&C server:

Analysis on file: bc86b20a3ce153698961b318399943f795a2a1b3