Backdoor:W32/Nanocore

Classification

Type:Backdoor

Summary

This threat is a Remote Access Tool (RAT) that allows the infected system to be remotely controlled and monitored by malicious actors.

Removal

The F-Secure security product will automatically remove the file.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.

Technical Details

Infection Vector

This threat is the payload of a multi-stage trojan-downloader, which usually arrives as a document file attached to email messages sent out as part of a spam email campaign.

Behavior

This RAT is used for surveillance and data exfiltration.

It remains persistent in the system by installing the Run registry and Scheduled tasks to execute itself during startup.

Autorun Keys:

Name: "SAAS Monitor"
Data: "c:\program files\saas monitor\saasmon.exe"

Scheduled Tasked:

\SAAS Monitor <%Malware Path%>
Example: \SAAS Monitor Task c:\program files\saas monitor\saasmon.exe

To protect its process, the RAT throws an exception which will cause the system to crash when its process is terminated.

This threat establishes a connection to a remote command-and-control (C&C) server and executes the command(s) issued by the C&C server.It provides the following details to the C&C server: