TF-1819567 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Nanocore RAT (aliases: Nancrat,NanoCore). Confidence: 75. First seen: 2026-05-28 17:45:30 UTC. Reporter: abuse_ch. Tags: NanoCore.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference Threatfox IOCs/Threats
• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Nanocore RAT (aliases: Nancrat,NanoCore). Confidence: 75. First seen: 2026-05-28 17:45:30 UTC. Reporter: abuse_ch. Tags: NanoCore.

• NanoCore, Software S0336 | MITRE ATT&CK®
  web:attack.mitre.org

  NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.

  2026-06-03 23:08 UTC
• Nanocore RAT (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Nanocore is a Remote Access Tool used to steal credentials and to spy on cameras. It as been used for a while by numerous criminal actors as well as by nation state threat actors.

  2026-06-03 23:08 UTC
• NanoCore RAT Hunting Guide. Analysis and tools for hunting ... - Medium
  web:medium.com

  NanoCore RAT Hunting Guide Analysis and tools for hunting NanoCore command-and-control NanoCore is a prevalent RAT (Remote Access Trojan) which is used by threat actors to spy on victims and ...

  2026-06-03 23:08 UTC
• Catching a RAT: How Redborder Detected and Contained NanoCore
  web:redborder.com

  NanoCore typically arrives via phishing attachments (e.g., Word documents or zipped executables). Once launched, it installs silently, establishes persistence and begins beaconing to its command-and-control (C2) server.

  2026-06-03 23:08 UTC
• NANOCORE Malware Information - Trend Micro
  web:success.trendmicro.com

  The stolen information is sent to the command and control (C&C) servers of the malware attacker. This RAT gathers the following data and sends it to its servers: Browser's user names and passwords File Transfer Protocol (FTP) clients or file manager software stored account information Email credentials of popular mail clients

  2026-06-03 23:08 UTC
• ThreatFox | jnxetp.sa.com
  web:threatfox.abuse.ch

  Nanocore RAT IOC: jnxetp.sa.com ( domain ) You are viewing the ThreatFox database entry for domain jnxetp.sa.com.

  2026-06-03 23:08 UTC
• NanoCore RAT Malware - Check Point Software
  web:www.checkpoint.com

  Once installed on a device, NanoCore establishes a connection with its command and control server and begins collecting and exfiltrating sensitive information from the infected computer. For example, the malware will steal and send login credentials cached by the user's browser, email client, and similar software.

  2026-06-03 23:08 UTC
• NanoCore Malware: Analysis, Detection, Removal | Huntress
  web:www.huntress.com

  NanoCore is a notorious remote access trojan ( RAT ) that gives attackers complete control over an infected system. It's a favorite in the cybercrime world for its low cost and modular design, allowing threat actors to steal data, spy on users, and deliver additional malware. Its primary targets are businesses and individuals, aiming to compromise sensitive information for financial gain. What ...

  2026-06-03 23:08 UTC
• Trojan:MSIL/NanoCore.TG!MTB - microsoft.com
  web:www.microsoft.com

  NanoCore is a second-stage malware classified as a remote access trojan ( RAT ) that helps attackers to perform remote code execution (RCE) on a compromised device. Once installed, attackers can use it to perform various tasks, such as installing malicious files and establishing communication with a command-and-control (C2) server.

  2026-06-03 23:08 UTC
• NanoCore RAT Malware Analysis - SharITSec
  web:www.sharitsec.eu.org

  NanoCore is a well-known Remote Access Trojan ( RAT ) used by threat actors for espionage, data theft, and system control. In this post, I will analyze a NanoCore RAT sample with the hash 18B476D37244CB0B435D7B06912E9193 and explore its behavior, obfuscation techniques, and deobfuscation process.

  2026-06-03 23:08 UTC

Only Available for Registered Users. Sign in to view.