S0336 NanoCore

malwareEnterprise

platformsWindows

also known asNanoCore

NanoCore is a modular remote access tool developed in.NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.

techniques used (13)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1056.001Keylogging
T1059.003Windows Command Shell
T1059.005Visual Basic
T1105Ingress Tool Transfer
T1112Modify Registry
T1123Audio Capture
T1125Video Capture
T1547.001Registry Run Keys / Startup Folder
T1573.001Symmetric Cryptography
T1685Disable or Modify Tools
T1686Disable or Modify System Firewall

used by groups (4)

Threat groups associated with this.

G0064APT33
G0078Gorgon Group
G0043Group5
G0083SilverTerrier

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan