MB-5b8cc33eec5651def4b6070e73145bbb11a5dba73e344497165cf528b318259b
high
📛 Threat Title
NanoCore: 1c7fad36b892bc9c21e6467252b3cf11.exe
Description
File type: exe. Size: 207872 bytes. Tags: exe, NanoCore, RAT. Reporter: abuse_ch. First seen: 2026-08-04 20:15:06.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_imphash
f34d5f2d4577ed6d9ceec516c1f5a744
IOC database
- Type
- hash_imphash
- Value
f34d5f2d4577ed6d9ceec516c1f5a744- First seen
- Last seen
- Attached to this threat
- Appears in
- 638 threats
- Description
- imphash of URLhaus payload 61d424c2e3c5d8db…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
5b8cc33eec5651def4b6070e73145bbb11a5dba73e344497165cf528b318259b
IOC database
- Type
- hash_sha256
- Value
5b8cc33eec5651def4b6070e73145bbb11a5dba73e344497165cf528b318259b- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- NanoCore
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
33a91b17832b2e20779cb8401eb1ba257a933ffb
IOC database
- Type
- hash_sha1
- Value
33a91b17832b2e20779cb8401eb1ba257a933ffb- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
1c7fad36b892bc9c21e6467252b3cf11
IOC database
- Type
- hash_md5
- Value
1c7fad36b892bc9c21e6467252b3cf11- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 207872 bytes. Tags: exe, NanoCore, RAT. Reporter: abuse_ch. First seen: 2026-08-04 20:15:06.
Remediations (10)
-
web:any.run
Online sandbox report for NanoCore_1.2.2.0.exe, tagged as susp-powershell, crypto-regex, verdict: Malicious activity
-
web:bazaar.abuse.ch
NanoCore malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as NanoCore . Database Entry
-
web:github.com
Nanocore download for those who want to do malware analysis on it and study it's behavior as well as play around with its features. - PaleoMenace/ NanoCore
-
web:malwr-analysis.com
NanoCore is a well-known Remote Access Trojan (RAT) used by threat actors for espionage, data theft, and system control. In this post, I will analyze a NanoCore RAT sample with the hash 18B476D37244CB0B435D7B06912E9193 and explore its behavior, obfuscation techniques, and deobfuscation process.
-
web:socradar.io
Nanocore analysis — IOCs, C2 infrastructure, behavior patterns, detection hashes, and linked threat actors. Free lookup by SOCRadar.
-
web:success.trendmicro.com
This advisory provides Trend Micro coverage for NanoCore malware that combines backdoor and info stealing capabilities.
-
web:support.gridinsoft.com
NanoCore is a remote access trojan (RAT) used by criminals to spy on victims, steal data, and control Windows PCs from afar. It can log keystrokes, grab screenshots, record from the webcam or mic, and drop more malware.
-
web:support.gridinsoft.com
NanoCore is a remote access trojan (RAT) used by criminals to spy on victims, steal data, and control Windows PCs from afar. It can log keystrokes, grab screenshots, record from the webcam or mic, and drop more malware.
-
web:www.huntress.com
NanoCore Removal Instructions If you suspect a NanoCore infection, disconnect the infected device from the network immediately to prevent further data exfiltration or lateral movement. Manual removal is complex and not recommended for non-experts, as the malware embeds itself deep within the system.
-
web:www.microsoft.com
Summary NanoCore is a second-stage malware classified as a remote access trojan (RAT) that helps attackers to perform remote code execution (RCE) on a compromised device. Once installed, attackers can use it to perform various tasks, such as installing malicious files and establishing communication with a command-and-control (C2) server.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.