MITRE ATT&CKsoftware (malware)
S0336 NanoCore
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2019-01-29
Description
NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.
Related
Uses · MITRE ATT&CK (13)
- T1685 Disable or Modify Tools technique
- T1686 Disable or Modify System Firewall technique
- T1573.001 Symmetric Cryptography sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1056.001 Keylogging sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1105 Ingress Tool Transfer technique
- T1112 Modify Registry technique
- T1123 Audio Capture technique
- T1125 Video Capture technique
References
- https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ Unit 42 Gorgon Group Aug 2018
- https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/ PaloAlto NanoCore Feb 2016
- https://web.archive.org/web/20240522112705/https://cofense.com/blog/nanocore-rat-resurfaced-sewers/ Cofense NanoCore Mar 2018
- https://www.digitrustgroup.com/nanocore-not-your-average-rat/ DigiTrust NanoCore Jan 2017