Nanocore RAT: New Infrastructure and Payload Indicators

ThreatFox has reported eight new indicators of compromise related to the Nanocore remote access trojan (RAT), consisting of malicious payloads and command-and-control (C2) infrastructure. These indicators reflect ongoing activity involving Nanocore, a known commodity RAT that provides attackers with extensive remote control capabilities over compromised Windows systems.

Impact

The identified C2 infrastructure (a dynamic DNS domain and a hardcoded IP address) allows for the remote management of infected hosts. The associated file hashes represent active payloads used in current distribution efforts.

Recommendation

• Block the identified C2 domain and IP address at your perimeter firewall and DNS resolvers.
• Implement file integrity monitoring to detect the presence of the identified malicious hashes on endpoints.
• Perform a threat hunt across EDR telemetry for connections to the identified C2 infrastructure.