s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-913e879e80d3e3dcf8341c43145ed5f6a85d1cdd2d3e0b5c006788dba6d2dc7c high

📛 Threat Title

NanoCore: aviarush.it.com.exe

Category: NanoCore Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: exe. Size: 207872 bytes. Tags: exe, NanoCore, RAT. Reporter: abuse_ch. First seen: 2026-05-14 15:00:05.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain aviarush.it.com.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/aviarush.it.com.exe

IOC database

Type
domain
Value
aviarush.it.com.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-913e879e80d3e3dcf8341c43145ed5f6a85d1cdd2d3e0b5c006788dba6d2dc7c

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/aviarush.it.com.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
648 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 913e879e80d3e3dcf8341c43145ed5f6a85d1cdd2d3e0b5c006788dba6d2dc7c VT 63 / 75 1 feed

IOC database

Type
hash_sha256
Value
913e879e80d3e3dcf8341c43145ed5f6a85d1cdd2d3e0b5c006788dba6d2dc7c
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
NanoCore

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →

Flagged by 63 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Win-Trojan/Nanocore.Exp
Alibaba malicious Trojan:Win32/NanoCore.348
alibabacloud malicious Backdoor:MSIL/Vindor.Gen
ALYac malicious Trojan.NanoCore.D
Antiy-AVL malicious Trojan/MSIL.NanoCore
APEX malicious Malicious
Arcabit malicious Trojan.NanoCore.D
Avast malicious MSIL:NanoCore-B [Trj]
AVG malicious MSIL:NanoCore-B [Trj]
Avira malicious TR/Dropper.MSIL.Gen7
BitDefender malicious Trojan.NanoCore.D
Bkav malicious W32.Malware.48C1EB09
CAT-QuickHeal malicious Trojan.Orbus.C3
ClamAV malicious Win.Trojan.NanoCore-9852758-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.nanocore
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Nanocore.23
Elastic malicious Windows.Trojan.Nanocore
Emsisoft malicious Trojan.NanoCore (A)
ESET-NOD32 malicious MSIL/NanoCore.E trojan
F-Secure malicious Trojan.TR/Dropper.MSIL.Gen7
Fortinet malicious MSIL/NanoCore.K!tr
GData malicious MSIL.Backdoor.Nancat.A
Google malicious Detected
Gridinsoft malicious Backdoor.Win32.Noancooe.cc!ni
huorong malicious Backdoor/MSIL.NanoCore.b
Jiangmin malicious Backdoor.Generic.zwu
K7AntiVirus malicious Trojan ( 005b2a921 )
K7GW malicious Trojan ( 0057b88c1 )
Kaspersky malicious Trojan.MSIL.Agent.fpar
Kingsoft malicious MSIL.Trojan.Agent.fpar
Lionic malicious Trojan.Win32.Generic.mhUN
Malwarebytes malicious Backdoor.NanoCore
McAfeeD malicious Real Protect-LS!0682E3D30CA2
Microsoft malicious Backdoor:MSIL/Nanocore!atmn
MicroWorld-eScan malicious Trojan.NanoCore.D
NANO-Antivirus malicious Trojan.Win32.NanoBot.hmqoyu
Paloalto malicious generic.ml
Panda malicious Bck/Agent.KNM
Rising malicious Backdoor.NanoCore!1.B6F9 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Trojan-FICC!0682E3D30CA2
Sophos malicious Troj/NanoCor-BT
SUPERAntiSpyware malicious Backdoor.Nanocore/Variant
Symantec malicious Trojan.Nancrat
TACHYON malicious Backdoor/W32.DN-Nanocore.207872
tehtris malicious Generic.Malware
Tencent malicious Trojan.Msil.Agent.fb
Trapmine malicious malicious.high.ml.score
TrellixENS malicious Trojan-FICC!0682E3D30CA2
TrendMicro malicious BKDR_NOANCOOE.SM
TrendMicro-HouseCall malicious BKDR_NOANCOOE.SM
Varist malicious W32/NanoCore.C.gen!Eldorado
VBA32 malicious Trojan.MSIL.NanoCore.Heur
VIPRE malicious Trojan.NanoCore.D
VirIT malicious Trojan.Win32.DownLoader12.BSON
ViRobot malicious Backdoor.Win32.NanoCore.Gen.A
Xcitium malicious Backdoor.MSIL.Noancooe.JDE@5s4u9t
ZoneAlarm malicious Troj/NanoCor-BT
Zoner malicious Trojan.Win32.48280

Details From VirusTotal

Basic Properties
MD50682e3d30ca2e40b93a3163339b1ee37
SHA-1bc7dff2ea2ba6fc6777747ad76f46429f70eb427
SHA-256913e879e80d3e3dcf8341c43145ed5f6a85d1cdd2d3e0b5c006788dba6d2dc7c
VHash22503665157170993c1160150
SSDEEP3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIyDP+1Nda82N+xdkv9iRLGeQLp:sLV6Bta6dtJmakIM5HkAgNpQ
TLSHT1E514CF267BB94A2FE2DE8AB9611212028379C2E3D9C3F3DE18D455B75F227E506071D3
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size203.0 KB
History
Creation date2015-02-22 00:49 UTC
First seen on VirusTotal2026-05-13 14:52 UTC
Last submission2026-05-14 15:08 UTC
Last analysis2026-06-12 06:02 UTC
Last modified on VirusTotal2026-06-18 20:53 UTC
Known Names
  • 913e879e80d3e3dcf8341c43145ed5f6a85d1cdd2d3e0b5c006788dba6d2dc7c.exe
  • 3d89k8.exe
  • aviarush.it.com
hash_sha1 bc7dff2ea2ba6fc6777747ad76f46429f70eb427 VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/bc7dff2ea2ba6fc6777747ad76f46429f70eb427
2 feeds

IOC database

Type
hash_sha1
Value
bc7dff2ea2ba6fc6777747ad76f46429f70eb427
First seen
Last seen
Attached to this threat
Appears in
2 threats

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/bc7dff2ea2ba6fc6777747ad76f46429f70eb427

hash_md5 0682e3d30ca2e40b93a3163339b1ee37 VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/0682e3d30ca2e40b93a3163339b1ee37
2 feeds

IOC database

Type
hash_md5
Value
0682e3d30ca2e40b93a3163339b1ee37
First seen
Last seen
Attached to this threat
Appears in
2 threats

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/0682e3d30ca2e40b93a3163339b1ee37

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: exe. Size: 207872 bytes. Tags: exe, NanoCore, RAT. Reporter: abuse_ch. First seen: 2026-05-14 15:00:05.

Remediations (10)

  • Malware Analysis - NanoCore - Bar Magnezi [0xMrMagnezi]
    web:0xmrmagnezi.github.io

    Summary NanoCore is a remote access Trojan (RAT) linked to Iranian threat actor APT33. It features multiple stages, anti-analysis techniques, and obfuscation. During analysis, I extracted its configuration, which revealed C2 domains, mutexes, bypass UAC, and other key details. The malware ensures persistence across reboots by impersonating legitimate processes and manipulating the registry ...

  • NanoCore RAT Analysis, Trojan Overview by ANY.RUN
    web:any.run

    NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins that allow attackers to tailor its functionality to their needs. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.

  • NanoCore, Software S0336 | MITRE ATT&CK®
    web:attack.mitre.org

    NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.

  • MalwareBazaar | NanoCore - abuse.ch
    web:bazaar.abuse.ch

    NanoCore malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as NanoCore . Database Entry

  • GitHub - PaleoMenace/NanoCore: Nanocore download for those who want to ...
    web:github.com

    About Nanocore download for those who want to do malware analysis on it and study it's behavior as well as play around with its features.

  • NanoCore RAT Malware Analysis
    web:malwr-analysis.com

    NanoCore is a well-known Remote Access Trojan (RAT) used by threat actors for espionage, data theft, and system control. In this post, I will analyze a NanoCore RAT sample with the hash 18B476D37244CB0B435D7B06912E9193 and explore its behavior, obfuscation techniques, and deobfuscation process.

  • NANOCORE Malware Information - Trend Micro
    web:success.trendmicro.com

    The NanoCore remote access Trojan (RAT) was first discovered in 2013 when it was being sold in underground forums. The malware has a variety of functions such as keylogger, a password stealer which can remotely pass along data to the malware operator. It also has the ability to tamper and view footage from webcams, screen locking, downloading and theft of files, and more. The current NanoCore ...

  • NanoCore Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    NanoCore Removal Instructions If you suspect a NanoCore infection, disconnect the infected device from the network immediately to prevent further data exfiltration or lateral movement. Manual removal is complex and not recommended for non-experts, as the malware embeds itself deep within the system.

  • Windows Analysis Report aviarush.it.com.exe
    web:www.joesandbox.com

    General Information Sample name: aviarush.it.com.exe Analysis ID: 1913548 Has dependencies: false MD5: 0682e3d30ca2e40b93a3163339b1ee37 SHA1: bc7dff2ea2ba6fc6777747ad76f46429f70eb427 SHA256: 913e879e80d3e3dcf8341c43145ed5f6a85d1cdd2d3e0b5c006788dba6d2dc7c Tags: exe, NanoCore , RAT Infos: yarasigma

  • NanoCore RAT Virus - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    What is the purpose of NanoCore RAT? In most cases, threat actors use RATs like NanoCore to drop additional payload (infect computers with ransomware, cryptominers, and other malware), steal sensitive information (for example, saved logins/passwords, credit card details), access files, execute commands. How did a malware infiltrate my computer?

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.