NanoCore RAT VBScript Loader Using Chr()/Math/Flow-Control Obfuscation to Evade Static Detection (CyberChef Analysis)

Key facts for NanoCore VBScript obfuscated loader

Detection coverage for NanoCore VBScript obfuscated loader

As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1480 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WSH Spawning PowerShell From chr()/CLng(&H)-Obfuscated VBScript Loader

Detects wscript.exe/cscript.exe spawning powershell.exe with no visible script path and NoProfile/NonInteractive/EncodedCommand-style flags, consistent with a NanoCore VBScript loader executing a chr()/CLng(&Hxxxx) math-reconstructed PowerShell command line after opening a .vbs email attachment.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.001, T1059.005, T1027
• Data sources: sysmon, windows_security, edr_process_telemetry
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage), child=lower(Image)
| where (like(parent, "%\\wscript.exe") OR like(parent, "%\\cscript.exe")) AND like(child, "%\\powershell.exe")
| where match(CommandLine, "(?i)-noprofile") OR match(CommandLine, "(?i)-nonint") OR match(CommandLine, "(?i)-enc(odedcommand)?\\s")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commandlines by host, User, ParentImage, Image, ParentCommandLine
| where count > 0

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe")
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-noprofile", "-nonint", "-enc", "-EncodedCommand")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| sort by Timestamp desc

Sigma

title: WSH Spawning PowerShell From Obfuscated VBScript Loader
id: 8b7c1a10-1f2d-4c3e-9a51-tl20261480sp1
status: experimental
description: Detects wscript.exe/cscript.exe launching powershell.exe with no visible script and NoProfile/NonInteractive/EncodedCommand flags, consistent with a NanoCore chr()/CLng() math-obfuscated VBScript loader decoding and launching a PowerShell payload.
references:
    - https://www.embeeresearch.io/advanced-cyberchef-techniques-defeating-nanocore-obfuscation-with-math-and-flow-control/
    - https://attack.mitre.org/techniques/T1027/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-18
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.005
    - attack.defense_evasion
    - attack.t1027
    - attack.tool.nanocore
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\wscript.exe'
            - '\\cscript.exe'
    selection_child:
        Image|endswith: '\\powershell.exe'
    selection_flags:
        CommandLine|contains:
            - '-NoProfile'
            - '-NonInteractive'
            - '-enc'
            - '-EncodedCommand'
    condition: selection_parent and selection_child and selection_flags
    falsepositives:
        - Legitimate admin/IT logon or deployment scripts that intentionally chain WSH to PowerShell
    level: high

Known false positives:

• Legitimate IT/logon scripts that deliberately chain wscript/cscript into powershell.exe for deployment automation

Tuning notes: Baseline known deployment/RMM tooling that legitimately chains WSH into PowerShell and exclude by signed publisher or known script hash; tighten by requiring absence of a .ps1 file path argument to reduce noise from scheduled admin scripts.

• 🔒 PowerShell Encoded/No-File Command Line Following WSH-Decoded Loader Execution · unlock with TL Creds
• 🔒 Commodity-RAT Collection Behavior: Keylogging/Screen/Webcam/Mic Capture API Access Post-Script-Execution · unlock with TL Creds
• 🔒 DES/Symmetric-Encrypted Custom-Protocol Beacon Correlated With Prior Script-Interpreter Execution · unlock with TL Creds
• 🔒 Spearphishing-Delivered VBScript Attachment Executed via Windows Script Host · unlock with TL Creds
• 🔒 System Discovery Command Sequence Immediately After Script-Interpreter Chain Execution · unlock with TL Creds
• 🔒 Length-Prefixed Encrypted TCP Beacon to Non-Standard Port 9632 (NanoCore Custom C2) · unlock with TL Creds
• 🔒 VBScript File With High-Density chr()/CLng(&Hxxxx) Math-Obfuscation and Comment-Bloat Padding · unlock with TL Creds
• 🔒 HKCU Run-Key Persistence Write Immediately Following Script-Interpreter Execution · unlock with TL Creds

Indicators of compromise for NanoCore VBScript obfuscated loader

As of 2026-07-18, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-1480.

How NanoCore VBScript obfuscated loader works

The technique defeats naive static/signature scanning by concentrating the real payload on a single line while padding the file with junk comments containing decoy content.

In September 2024, Embee Research published a technical breakdown of a VBScript-based loader distributing the NanoCore Remote Access Trojan. The loader (SHA256 c6092b1788722f82280d3dca79784556df6b8203f4d8f27c327582dd9dcf6e1, sourced from MalwareBazaar) is roughly 160 lines long, but the vast majority of those lines are non-functional comments used purely as junk-code padding (MITRE T1027.016) to inflate file size, break simple line-count/entropy heuristics, and distract analysts. The actual malicious logic is concentrated on a single line near the top of the file.

The core obfuscation primitive is a chr()-based character reconstruction: each character of the hidden PowerShell command is represented as a VBScript chr() call whose argument is derived from a mathematical expression rather than a plain integer, e.g. chr(479808/CLng(&H1b90)) evaluates to the ASCII character for 'D'. The loader alternates between two operator classes across its encoded value pairs -- some segments use division (large decimal numerator divided by a CLng()-cast hexadecimal denominator) and others use addition (decimal + hexadecimal operand pairs) -- forcing an analyst or automated deobfuscator to branch on operator type per token rather than applying one uniform transform. Mixed decimal and hexadecimal (&Hxxxx / CLng()) representations are interleaved within the same expression, which defeats simple regex-only decoders that only handle one numeral base.

Embee Research's writeup provides a CyberChef recipe (14 chained operations) to defeat the scheme: regex-extract the chr(...) argument expressions, use CyberChef's Subsection operation to isolate and separately handle the division-pattern tokens versus the addition-pattern tokens, normalize the VBScript CLng(&Hxxxx) hex delimiter syntax to a standard 0x-prefixed form so CyberChef's Divide/Sum operations with space-delimited output can evaluate the arithmetic, and finally convert the resulting decimal ASCII codes back to characters (Decimal to Character / From Decimal). The decoded output is a Base64/plaintext PowerShell command line that downloads and/or directly launches the NanoCore .NET payload in memory.

NanoCore itself is a long-running, low-cost ($25 in underground markets), plugin-based, .NET-compiled commodity RAT first observed in 2013, whose creator (Taylor Huddleston) was sentenced to federal prison in 2018 -- yet the malware remains actively distributed via crimeware loaders and phishing campaigns years later, illustrating the persistent commodity-RAT threat even after operator prosecution. Once deployed, NanoCore establishes persistence via HKCU Run-key registry entries, communicates over a custom TCP protocol (commonly observed on port 9632, though non-standard ports vary by campaign) using DES-encrypted (hardcoded key/IV) packets prefixed by a 4-byte length field, and offers a plugin architecture supporting keylogging, webcam/microphone capture, screen capture, remote desktop, file management, and credential theft. It has been used by both financially-motivated crimeware operators and, per third-party attribution references, actors associated with APT33/Elfin and the Gorgon Group, and is frequently observed co-distributed or co-occurring with other commodity RATs/stealers such as AsyncRAT, njRAT, Remcos, Agent Tesla, RedLine Stealer, Quasar RAT, NetWire, and Crimson RAT in shared loader/crimeware-as-a-service ecosystems.

This loader represents a defense-evasion-focused delivery stage rather than a novel exploit: there is no CVE, no exploitation of a software vulnerability, and no confirmed in-the-wild targeting data in the source article. Its significance for defenders is purely in the static/behavioral detection gap it creates -- YARA/regex rules keyed on plain chr()-chain obfuscation or simple Base64 patterns will miss this variant because the encoded values require arithmetic evaluation before the payload is visible, and the comment-bloat padding skews file-size and entropy-based heuristics.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution

Credential Access

T1056 Input Capture

Collection

T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery

Persistence

T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1547 Boot or Logon Autostart Execution

Initial Access

T1566 Phishing

Remediation for NanoCore VBScript obfuscated loader

Immediate actions

• Block execution of .vbs/.vbe/.wsf script attachments at the email gateway
• Enable Windows Script Host (WSH) restrictions or disable WSH entirely on endpoints that do not require it (HKCU/HKLM Software\Microsoft\Windows Script Host\Settings\Enabled = 0)
• Alert on wscript.exe / cscript.exe spawning powershell.exe as a child process
• Hunt for VBScript files containing high densities of chr()/CLng()/&H hex-literal tokens combined with large comment-to-code line ratios
• Block outbound TCP connections to known NanoCore C2 ports (commonly 9632, but variable) from workstation subnets to the internet where not business-justified

Workarounds

• Disable Windows Script Host via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows Script Host)
• Change default file handler association for .vbs/.vbe/.js/.wsf from wscript.exe to Notepad to prevent accidental double-click execution

Longer-term hardening

• Deploy AMSI-integrated script-content scanning (deobfuscated content, not raw file) for PowerShell and VBScript execution
• Implement application allowlisting / Windows Defender Application Control to prevent unsigned script interpreters from launching
• Enable PowerShell Script Block Logging (Event ID 4104) and VBScript/WSH execution logging enterprise-wide
• Deploy EDR behavioral detection for HKCU Run-key persistence writes combined with recent script-interpreter parentage
• Segment and monitor for custom non-HTTP(S) TCP protocols on egress, particularly DES-encrypted length-prefixed streams characteristic of NanoCore's C2

Affected and fixed versions

• Microsoft — Windows Script Host
  Vulnerable versions: all versions with WSH enabled

Timeline of NanoCore VBScript obfuscated loader

• 2013-01-01 locked-ioc-16 RAT first observed in the wild as a low-cost ($25), plugin-based .NET commodity remote access trojan; an alpha version leaks on underground forums in late 2013.
• 2014-01-01 Taylor Huddleston, using the HackForums alias 'Aeonhack,' begins advertising and selling locked-ioc-16 RAT and his companion Net Seal licensing platform, continuing through February 2016.
• 2015-01-01 The first full-featured version of locked-ioc-16, including its premium plugin architecture (keylogging, webcam/mic capture, remote desktop), is leaked in its entirety on criminal forums, enabling widespread unauthorized redistribution.
• 2015-09-01 The FBI opens an investigation into the Net Seal licensing platform's role in facilitating malware distribution, an inquiry that ultimately leads investigators to locked-ioc-16 RAT and its author.
• 2017-02-01 Taylor Huddleston is arrested by U.S. authorities and charged with aiding and abetting computer intrusions in connection with locked-ioc-16 RAT and Net Seal.
• 2018-07-05 Taylor Huddleston is sentenced to 33 months in federal prison; the malware nonetheless continues to circulate and be repurposed by third-party operators via crimeware loaders, illustrating persistence of commodity RATs beyond original-developer prosecution.
• 2024-09-03 locked-ioc-11 releases a 14-operation locked-ioc-15 recipe combining regex extraction, Subsection-based flow control, hex-delimiter normalization, and Divide/Sum arithmetic operations to fully decode the hidden PowerShell/locked-ioc-16 payload.
• 2024-09-03 Analyzed VBScript loader sample sourced from MalwareBazaar for public research and detection-engineering purposes.
• 2024-09-03 locked-ioc-11 publishes 'Advanced locked-ioc-15 Techniques: Defeating locked-ioc-16 Obfuscation With Math and Flow Control,' detailing a VBScript loader sample (SHA256 locked-ioc-3) using chr()/math/hex-decimal obfuscation plus comment bloat to conceal a NanoCore-launching PowerShell command.
• 2026-07-18 TL-Intel-Harness RSS hunt phase ingests the locked-ioc-11 article and opens threat TL-2026-1480 for detection-engineering coverage of the obfuscation pattern.

Sources cited for NanoCore VBScript obfuscated loader

• NanoCore RAT (Malware Family) malpedia.caad.fkie.fraunhofer.de · Research · 2026-07-18
• NanoCore Malware: Analysis, Detection, Removal Huntress · Vendor report · 2026-07-18
• Multistage Loader used to spread AZORult and NanoCore zscaler.com · Vendor report · 2026-07-18
• Analysis of top non-HTTP/S threats (NanoCore custom protocol) zscaler.com · Vendor report · 2026-07-18
• NanoCore RAT Malware Check Point · Vendor report · 2026-07-18
• MalwareBazaar - NanoCore samples bazaar.abuse.ch · Research · 2026-07-18
• Obfuscated Files or Information, Technique T1027 - MITRE ATT&CK MITRE · Research · 2026-07-18
• Obfuscated Files or Information: Junk Code Insertion, T1027.016 MITRE · Research · 2026-07-18
• Advanced Cyberchef Techniques - Defeating Nanocore Obfuscation With Math and Flow Control embeeresearch.io · Blog · 2024-09-03
• VBS Dropper Script for Nanocore RAT. Fileless Properties. malscope.com · Blog · 2026-07-18
• NanoCore RAT Malware Analysis malwr-analysis.com · Blog · 2025-02-10

Threats related to NanoCore VBScript obfuscated loader

• WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)
• Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign
• Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
• TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry
• XWorm v6.4 Delivery Campaign — Obfuscated JavaScript/PowerShell Loaders with ProcessHollowing DLL Injection (March 2026)

Related coverage of this activity

• Woodgnat Node.js LOTL campaign
• Millenium RAT ShinyEnigma MaaS
• SmartLoader EQVita GitHub lure
• Remcos COM UAC bypass
• Millenium RAT v4

Previous and next in malware

• RedWing: Android Malware-as-a-Service Spyware Operation Targeting Russian Financial Institutions Previous report
• HTA-Based Cobalt Strike Downloader Script Analysis (CyberChef Deobfuscation) Next report