# NanoCore RAT VBScript Loader Using Chr()/Math/Flow-Control Obfuscation to Evade Static Detection (CyberChef Analysis)

> Embee Research dissected a VBScript (.vbs) loader for the NanoCore RAT that hides a PowerShell-launched payload behind a multi-layered obfuscation scheme combining chr() ASCII conversion, mixed division/addition math on decimal and hexadecimal operands, and ~160 lines of non-functional comment bloat. The technique defeats naive static/signature scanning by concentrating the real payload on a single line while padding the file with junk comments containing decoy content.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1480
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-nanocore-vbscript-obfuscated-loader-tl-2026-1480.webp?v=64a066b3 (Threadlinqs threat intel: NanoCore RAT VBScript Chr() Loader: Detection & IOCs (TL-2026-1480) — Medium severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-1480
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20

## Description

In September 2024, Embee Research published a technical breakdown of a VBScript-based loader distributing the NanoCore Remote Access Trojan. The loader (SHA256 c6092b1788722f82280d3dca79784556df6b8203f4d8f27c327582dd9dcf6e1, sourced from MalwareBazaar) is roughly 160 lines long, but the vast majority of those lines are non-functional comments used purely as junk-code padding (MITRE T1027.016) to inflate file size, break simple line-count/entropy heuristics, and distract analysts. The actual malicious logic is concentrated on a single line near the top of the file.

The core obfuscation primitive is a chr()-based character reconstruction: each character of the hidden PowerShell command is represented as a VBScript chr() call whose argument is derived from a mathematical expression rather than a plain integer, e.g. chr(479808/CLng(&H1b90)) evaluates to the ASCII character for 'D'. The loader alternates between two operator classes across its encoded value pairs -- some segments use division (large decimal numerator divided by a CLng()-cast hexadecimal denominator) and others use addition (decimal + hexadecimal operand pairs) -- forcing an analyst or automated deobfuscator to branch on operator type per token rather than applying one uniform transform. Mixed decimal and hexadecimal (&Hxxxx / CLng()) representations are interleaved within the same expression, which defeats simple regex-only decoders that only handle one numeral base.

Embee Research's writeup provides a CyberChef recipe (14 chained operations) to defeat the scheme: regex-extract the chr(...) argument expressions, use CyberChef's Subsection operation to isolate and separately handle the division-pattern tokens versus the addition-pattern tokens, normalize the VBScript CLng(&Hxxxx) hex delimiter syntax to a standard 0x-prefixed form so CyberChef's Divide/Sum operations with space-delimited output can evaluate the arithmetic, and finally convert the resulting decimal ASCII codes back to characters (Decimal to Character / From Decimal). The decoded output is a Base64/plaintext PowerShell command line that downloads and/or directly launches the NanoCore .NET payload in memory.

NanoCore itself is a long-running, low-cost ($25 in underground markets), plugin-based, .NET-compiled commodity RAT first observed in 2013, whose creator (Taylor Huddleston) was sentenced to federal prison in 2018 -- yet the malware remains actively distributed via crimeware loaders and phishing campaigns years later, illustrating the persistent commodity-RAT threat even after operator prosecution. Once deployed, NanoCore establishes persistence via HKCU Run-key registry entries, communicates over a custom TCP protocol (commonly observed on port 9632, though non-standard ports vary by campaign) using DES-encrypted (hardcoded key/IV) packets prefixed by a 4-byte length field, and offers a plugin architecture supporting keylogging, webcam/microphone capture, screen capture, remote desktop, file management, and credential theft. It has been used by both financially-motivated crimeware operators and, per third-party attribution references, actors associated with APT33/Elfin and the Gorgon Group, and is frequently observed co-distributed or co-occurring with other commodity RATs/stealers such as AsyncRAT, njRAT, Remcos, Agent Tesla, RedLine Stealer, Quasar RAT, NetWire, and Crimson RAT in shared loader/crimeware-as-a-service ecosystems.

This loader represents a defense-evasion-focused delivery stage rather than a novel exploit: there is no CVE, no exploitation of a software vulnerability, and no confirmed in-the-wild targeting data in the source article. Its significance for defenders is purely in the static/behavioral detection gap it creates -- YARA/regex rules keyed on plain chr()-chain obfuscation or simple Base64 patterns will miss this variant because the encoded values require arithmetic evaluation before the payload is visible, and the comment-bloat padding skews file-size and entropy-based heuristics.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1218 System Binary Proxy Execution
- T1056 Input Capture
- T1113 Screen Capture
- T1125 Video Capture
- T1123 Audio Capture
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1219 Remote Access Tools
- T1082 System Information Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WSH Spawning PowerShell From chr()/CLng(&H)-Obfuscated VBScript Loader** (`TL-2026-1480-SPL-001`)

Detects wscript.exe/cscript.exe spawning powershell.exe with no visible script path and NoProfile/NonInteractive/EncodedCommand-style flags, consistent with a NanoCore VBScript loader executing a chr()/CLng(&Hxxxx) math-reconstructed PowerShell command line after opening a .vbs email attachment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.001, T1059.005, T1027
- **Data sources:** sysmon, windows_security, edr_process_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage), child=lower(Image)
| where (like(parent, "%\\wscript.exe") OR like(parent, "%\\cscript.exe")) AND like(child, "%\\powershell.exe")
| where match(CommandLine, "(?i)-noprofile") OR match(CommandLine, "(?i)-nonint") OR match(CommandLine, "(?i)-enc(odedcommand)?\\s")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commandlines by host, User, ParentImage, Image, ParentCommandLine
| where count > 0
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe")
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-noprofile", "-nonint", "-enc", "-EncodedCommand")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| sort by Timestamp desc
```

### Sigma

```yaml
title: WSH Spawning PowerShell From Obfuscated VBScript Loader
id: 8b7c1a10-1f2d-4c3e-9a51-tl20261480sp1
status: experimental
description: Detects wscript.exe/cscript.exe launching powershell.exe with no visible script and NoProfile/NonInteractive/EncodedCommand flags, consistent with a NanoCore chr()/CLng() math-obfuscated VBScript loader decoding and launching a PowerShell payload.
references:
    - https://www.embeeresearch.io/advanced-cyberchef-techniques-defeating-nanocore-obfuscation-with-math-and-flow-control/
    - https://attack.mitre.org/techniques/T1027/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-18
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.005
    - attack.defense_evasion
    - attack.t1027
    - attack.tool.nanocore
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\wscript.exe'
            - '\\cscript.exe'
    selection_child:
        Image|endswith: '\\powershell.exe'
    selection_flags:
        CommandLine|contains:
            - '-NoProfile'
            - '-NonInteractive'
            - '-enc'
            - '-EncodedCommand'
    condition: selection_parent and selection_child and selection_flags
    falsepositives:
        - Legitimate admin/IT logon or deployment scripts that intentionally chain WSH to PowerShell
    level: high
```

**Known false positives:**

- Legitimate IT/logon scripts that deliberately chain wscript/cscript into powershell.exe for deployment automation

**Tuning notes:** Baseline known deployment/RMM tooling that legitimately chains WSH into PowerShell and exclude by signed publisher or known script hash; tighten by requiring absence of a .ps1 file path argument to reduce noise from scheduled admin scripts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PowerShell Encoded/No-File Command Line Following WSH-Decoded Loader Execution (locked: unlock with TL Creds)
- Commodity-RAT Collection Behavior: Keylogging/Screen/Webcam/Mic Capture API Access Post-Script-Execution (locked: unlock with TL Creds)
- DES/Symmetric-Encrypted Custom-Protocol Beacon Correlated With Prior Script-Interpreter Execution (locked: unlock with TL Creds)
- Spearphishing-Delivered VBScript Attachment Executed via Windows Script Host (locked: unlock with TL Creds)
- System Discovery Command Sequence Immediately After Script-Interpreter Chain Execution (locked: unlock with TL Creds)
- Length-Prefixed Encrypted TCP Beacon to Non-Standard Port 9632 (NanoCore Custom C2) (locked: unlock with TL Creds)
- VBScript File With High-Density chr()/CLng(&Hxxxx) Math-Obfuscation and Comment-Bloat Padding (locked: unlock with TL Creds)
- HKCU Run-Key Persistence Write Immediately Following Script-Interpreter Execution (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Advanced Cyberchef Techniques - Defeating Nanocore Obfuscation With Math and Flow Control](https://www.embeeresearch.io/advanced-cyberchef-techniques-defeating-nanocore-obfuscation-with-math-and-flow-control/)
- [NanoCore RAT (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore)
- [NanoCore Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/nanocore)
- [VBS Dropper Script for Nanocore RAT. Fileless Properties.](https://malscope.com/post/nanocore-rat-dropper-fileless/)
- [Multistage Loader used to spread AZORult and NanoCore](https://www.zscaler.com/blogs/security-research/multistage-freedom-loader-used-spread-azorult-and-nanocore-rat)
- [Analysis of top non-HTTP/S threats (NanoCore custom protocol)](https://www.zscaler.com/blogs/security-research/catching-rats-over-custom-protocols)
- [NanoCore RAT Malware Analysis](https://malwr-analysis.com/2025/02/10/nanocore-rat-malware-analysis/)
- [NanoCore RAT Malware](https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/nanocore-rat-malware/)
- [MalwareBazaar - NanoCore samples](https://bazaar.abuse.ch/browse/tag/NanoCore/)
- [Obfuscated Files or Information, Technique T1027 - MITRE ATT&CK](https://attack.mitre.org/techniques/T1027/)
- [Obfuscated Files or Information: Junk Code Insertion, T1027.016](https://attack.mitre.org/techniques/T1027/016/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1480