Threat reportMalwareTL-2026-4792
Nanocore RAT delivered via math-obfuscated VBScript loader (CyberChef deobfuscation walkthrough)
Embee Research documents a VBScript loader that hides its payload behind division/addition-based numeric obfuscation, alternating hex and decimal literals and chr() ASCII conversion. The deobfuscated script runs a PowerShell command that delivers the NanoCore remote access trojan. First disclosed .
Key facts for NanoCore RAT VBScript loader
| Identifiers | TL-2026-4792 |
|---|---|
| Severity | MEDIUM |
| First disclosed | |
| Exploitation status | Exploited in the wild |
| Affected products | Microsoft Windows (Windows Script Host and PowerShell) |
| Malware | NanoCore, Nanocore RAT |
| MITRE ATT&CK techniques | T1027 Obfuscated Files or Information, T1055.012 Process Hollowing, T1056.001 Keylogging, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1112 Modify Registry, T1123 Audio Capture, T1125 Video Capture, T1140 Deobfuscate/Decode Files or Information, T1547.001 Registry Run Keys / Startup Folder, T1573.001 Symmetric Cryptography and 2 more in the attack flow |
| Motivation | UNKNOWN |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage for NanoCore RAT VBScript loader
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4792 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: NanoCore VBScript Loader - wscript/cscript Spawning PowerShell or cmd (SPL)
Detects Windows Script Host (wscript.exe/cscript.exe) spawning powershell.exe, pwsh.exe or cmd.exe, the hand-off used by the math-obfuscated (chr/CLng hex-decimal division) VBScript loader that delivers the NanoCore RAT in TL-2026-4792. Flags encoded/hidden/download PowerShell arguments and scripts launched from user-writable paths.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1059.005, T1059.001, T1059.003, T1027, T1140
- Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
- Severity: high
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe")
(Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe")
| eval cmd=lower(CommandLine), parent_cmd=lower(ParentCommandLine)
| eval ps_suspicious=if(match(cmd,"(-enc|-encodedcommand|downloadstring|downloadfile|invoke-expression|iex\\s|frombase64string|-w(indowstyle)?\\s+hidden|-nop|-ep\\s+bypass|pastebin\\.com)"),1,0)
| eval vbs_user_path=if(match(parent_cmd,"\\\\(appdata|temp|downloads|users\\\\public)\\\\"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentCommandLine) as vbs_cmdline values(CommandLine) as child_cmdline max(ps_suspicious) as ps_suspicious max(vbs_user_path) as vbs_user_path by Computer, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| sort 0 -ps_suspicious -countMicrosoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| extend PsSuspicious = ProcessCommandLine matches regex @"(?i)(-enc|-encodedcommand|downloadstring|downloadfile|invoke-expression|\biex\b|frombase64string|-w(indowstyle)?\s+hidden|-nop|-ep\s+bypass|pastebin\.com)"
| extend VbsUserPath = InitiatingProcessCommandLine matches regex @"(?i)\\(appdata|temp|downloads|users\\public)\\"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, PsSuspicious, VbsUserPath
| order by Timestamp descSigma
title: Script Host Spawning PowerShell or Command Shell - NanoCore VBScript Loader
id: 6d0e4792-1a01-4b7c-8f31-5c2d9e7a0001
status: experimental
description: Detects wscript.exe or cscript.exe spawning powershell.exe, pwsh.exe or cmd.exe, the execution hand-off used by the math-obfuscated VBScript loader that delivers NanoCore (TL-2026-4792).
references:
- https://www.embeeresearch.io/advanced-cyberchef-techniques-defeating-nanocore-obfuscation-with-math-and-flow-control/
- https://attack.mitre.org/software/S0336/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
- attack.execution
- attack.t1059.005
- attack.t1059.001
- attack.t1059.003
- attack.defense-evasion
- attack.t1027
- attack.t1140
- attack.s0336
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\wscript.exe'
- '\cscript.exe'
selection_child:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\cmd.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate logon or admin scripts that call PowerShell from VBScript
- Software deployment and inventory tooling using Windows Script Host
level: high
Known false positives:
- Legitimate logon scripts or admin automation that invoke PowerShell from VBScript
- Software deployment and inventory agents that use Windows Script Host
Tuning notes: Baseline parent script paths and allow-list signed enterprise scripts (by path or hash). Raise priority when ps_suspicious=1 or the script runs from AppData/Temp/Downloads. Hunt the sample SHA256 c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1 in file/mail telemetry separately. Requires Sysmon EventCode 1 (or MDE DeviceProcessEvents) with command-line capture.
- NanoCore VBScript Loader - wscript/cscript Spawning PowerShell or cmd (KQL) · unlock with TL Creds
- NanoCore Persistence - Run/RunOnce Key Launching VBScript (KQL) · unlock with TL Creds
- NanoCore C2 - RegSvcs/MSBuild/RegAsm Outbound and Related Infrastructure (KQL) · unlock with TL Creds
- NanoCore VBScript Loader - wscript/cscript Spawning PowerShell or cmd (Sigma) · unlock with TL Creds
- NanoCore Persistence - Run/RunOnce Key Launching VBScript (Sigma) · unlock with TL Creds
- NanoCore C2 - RegSvcs/MSBuild/RegAsm Outbound and Related Infrastructure (Sigma) · unlock with TL Creds
- NanoCore Persistence - Run/RunOnce Key Launching VBScript (SPL) · unlock with TL Creds
- NanoCore C2 - RegSvcs/MSBuild/RegAsm Outbound and Related Infrastructure (SPL) · unlock with TL Creds
Indicators of compromise for NanoCore RAT VBScript loader
As of 2026-10-30, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-4792.
Sample indicators (3 of 12)
- IP address:
216.170.114[.]4 - Domain:
won2020[.]duckdns[.]org - File hash:
c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1
Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.
How NanoCore RAT VBScript loader works
In a September 2024 walkthrough, Embee Research analyzes a VBScript (.vbs) loader (SHA256 c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1, sourced from MalwareBazaar) that delivers NanoCore. The script is roughly 160 lines, the majority of which are comments that mask the functional code. It conceals its logic with arithmetic obfuscation: large decimal values are divided by hex literals (for example chr(479808/CLng(&H1B90)) yields the character 'D', repeated throughout line 2), hex and decimal operands alternate, addition and division operators produce ASCII character codes, CLng() converts hex to decimal and chr() converts the result to a character. The actual payload is embedded in the script's comment sections, so it must be restored after naive comment removal, and the flow-control structure is manipulated to hinder static reading. Once decoded, the script executes a PowerShell command that runs the NanoCore payload.
The analyst deobfuscates the script in CyberChef using regular-expression isolation, Find/Replace, Fork/Subsection/Merge, Divide and Sum operations (space-delimited), From Decimal and whitespace removal. The source article is a deobfuscation tutorial; it makes no CVE, CVSS, actor-attribution or exploitation-status claims and exposes no network indicators (no URLs, domains or IPs) beyond the sample hash. Severity is analyst-assigned (MEDIUM) and the value is primarily detection engineering for script-loader obfuscation.
NanoCore itself is a modular .NET remote access tool active since 2013 (MITRE ATT&CK S0336, entry created 2019-01-29, last modified 2024-09-25). ATT&CK documents audio and video capture, keylogging, Windows command shell and VBS execution, registry modification, Registry Run key persistence, ingress tool transfer, system network configuration discovery, firewall and security-tool tampering, obfuscated files, and symmetric-cryptography C2 channels. Plugins are obfuscated with Eazfuscator.NET and RunOnce keys launching VBS scripts are documented.
For context only, other publicly documented NanoCore campaigns (Zscaler FreeDom loader; Morphisec) use Pastebin-hosted PowerShell and .NET injectors, process hollowing into RegSvcs.exe, MSBuild.exe and notepad.exe, AutoIt-based loaders, and scheduled-task or Run-key persistence. Those indicators are listed as related-campaign context and are not confirmed to belong to the analyzed sample. BeaconBeagle returned no C2 config match for won2020.duckdns.org and no beacon record for 216.170.114.4.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1027 Obfuscated Files or Information; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information
Collection
T1056.001 Keylogging; T1123 Audio Capture; T1125 Video Capture
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall
Persistence
T1547.001 Registry Run Keys / Startup Folder
Command and Control
Remediation for NanoCore RAT VBScript loader
Immediate actions
- Block and hunt for the sample SHA256 c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1 across endpoint and mail telemetry
- Alert on wscript.exe or cscript.exe spawning powershell.exe
- Hunt for new HKCU Run/RunOnce entries that launch .vbs files
Workarounds
- Associate .vbs and .vbe files with a non-executing handler such as Notepad
- Apply AppLocker or WDAC policy to block script execution from user-writable paths
Longer-term hardening
- Deploy EDR with script-behavior and AMSI-based detection for obfuscated VBScript and PowerShell
- Restrict or disable Windows Script Host for users who do not need it
- Enable PowerShell Script Block and Module logging and forward to the SIEM
Affected and fixed versions
- Microsoft — Windows (Windows Script Host and PowerShell)
Vulnerable versions: Windows endpoints with Windows Script Host enabled
Timeline of NanoCore RAT VBScript loader
- locked-ioc-12 RAT active since 2013 per MITRE ATT&CK S0336 (year-level date).
- MITRE ATT&CK creates the locked-ioc-12 software entry S0336.
- Embee Research publishes the CyberChef deobfuscation walkthrough showing the script executes a PowerShell command that runs locked-ioc-12.
- Article documents division/addition obfuscation, hex/decimal alternation, CLng()/chr() conversion, comment-masked code and payload hidden in comments.
- Embee Research analyzes the math-obfuscated VBScript loader (SHA256 c6092b17...f6e1) sourced from MalwareBazaar.
- MITRE ATT&CK last modifies the locked-ioc-12 S0336 entry (techniques include audio/video capture, keylogging, registry modification, firewall and tool tampering).
- Threat cataloged in the Threadlinqs platform for monitoring; no CVE, KEV listing or attribution exists for this sample.
Sources cited for NanoCore RAT VBScript loader
- MITRE ATT&CK: NanoCore (S0336) MITRE · Research · 2024-09-25
- Zscaler: Multistage FreeDom loader used to spread Azorult and NanoCore RAT zscaler.com · Vendor report
- Morphisec: NanoCore RAT Under the Microscope morphisec.com · Vendor report
- MalwareBazaar sample c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1 bazaar.abuse.ch · Research
- Cofense: NanoCore coverage cofense.com · Vendor report
- Advanced Cyberchef Techniques - Defeating Nanocore Obfuscation With Math and Flow Control embeeresearch.io · Blog · 2024-09-03
- SOC Prime: Nanocore RAT Detection socprime.com · Blog
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
