Backdoor:W32/Nanocore

Classification

Category:

Malware

Platform:

W32

Type:

Backdoor

Aliases:

Backdoor:W32/Nanocore

Summary

This threat is a Remote Access Tool (RAT) that allows the infected system to be remotely controlled and monitored by malicious actors.

Removal

Technical Details

Infection Vector

This threat is the payload of a multi-stage trojan-downloader, which usually arrives as a document file attached to email messages sent out as part of a spam email campaign.

Behavior

This RAT is used for surveillance and data exfiltration.

It remains persistent in the system by installing the Run registry and Scheduled tasks to execute itself during startup.

Autorun Keys:

Name: "SAAS Monitor"
Data: "c:\program files\saas monitor\saasmon.exe"

Scheduled Tasked:

\SAAS Monitor <%Malware Path%>
Example: \SAAS Monitor Task c:\program files\saas monitor\saasmon.exe

To protect its process, the RAT throws an exception which will cause the system to crash when its process is terminated.

This threat establishes a connection to a remote command-and-control (C&C) server and executes the command(s) issued by the C&C server.It provides the following details to the C&C server:

System information

Current active window
CPU Usage
RAM Usage
PING
Client country
Workstation name
Idle time
OS
OS bit
Access rights
Anti-Virus application
Anti-Spyware application
Firewall application

This threat is capable to execute these function on the infected system when connected to the C&C server:

Analysis on file: bc86b20a3ce153698961b318399943f795a2a1b3

More Support

Community

Ask questions in our Community.

User guides

Check the user guide for instructions.

Contact Support

Chat with with or call an agent.

Submit a Sample

Submit a file or URL for analysis.