# Nanocore RAT delivered via math-obfuscated VBScript loader (CyberChef deobfuscation walkthrough)

> Embee Research documents a VBScript loader that hides its payload behind division/addition-based numeric obfuscation, alternating hex and decimal literals and chr() ASCII conversion. The deobfuscated script runs a PowerShell command that delivers the NanoCore remote access trojan.

- **Published:** 2026-10-30T02:33:44Z
- **Last reviewed:** 2026-10-30T02:33:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4792
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4792.png
- **ID:** TL-2026-4792
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (3 shown free below)

## Description

In a September 2024 walkthrough, Embee Research analyzes a VBScript (.vbs) loader (SHA256 c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1, sourced from MalwareBazaar) that delivers NanoCore. The script is roughly 160 lines, the majority of which are comments that mask the functional code. It conceals its logic with arithmetic obfuscation: large decimal values are divided by hex literals (for example chr(479808/CLng(&H1B90)) yields the character 'D', repeated throughout line 2), hex and decimal operands alternate, addition and division operators produce ASCII character codes, CLng() converts hex to decimal and chr() converts the result to a character. The actual payload is embedded in the script's comment sections, so it must be restored after naive comment removal, and the flow-control structure is manipulated to hinder static reading. Once decoded, the script executes a PowerShell command that runs the NanoCore payload.

The analyst deobfuscates the script in CyberChef using regular-expression isolation, Find/Replace, Fork/Subsection/Merge, Divide and Sum operations (space-delimited), From Decimal and whitespace removal. The source article is a deobfuscation tutorial; it makes no CVE, CVSS, actor-attribution or exploitation-status claims and exposes no network indicators (no URLs, domains or IPs) beyond the sample hash. Severity is analyst-assigned (MEDIUM) and the value is primarily detection engineering for script-loader obfuscation.

NanoCore itself is a modular .NET remote access tool active since 2013 (MITRE ATT&CK S0336, entry created 2019-01-29, last modified 2024-09-25). ATT&CK documents audio and video capture, keylogging, Windows command shell and VBS execution, registry modification, Registry Run key persistence, ingress tool transfer, system network configuration discovery, firewall and security-tool tampering, obfuscated files, and symmetric-cryptography C2 channels. Plugins are obfuscated with Eazfuscator.NET and RunOnce keys launching VBS scripts are documented.

For context only, other publicly documented NanoCore campaigns (Zscaler FreeDom loader; Morphisec) use Pastebin-hosted PowerShell and .NET injectors, process hollowing into RegSvcs.exe, MSBuild.exe and notepad.exe, AutoIt-based loaders, and scheduled-task or Run-key persistence. Those indicators are listed as related-campaign context and are not confirmed to belong to the analyzed sample. BeaconBeagle returned no C2 config match for won2020.duckdns.org and no beacon record for 216.170.114.4.

## MITRE ATT&CK

- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055.012 Process Hollowing
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1547.001 Registry Run Keys / Startup Folder
- T1056.001 Keylogging
- T1123 Audio Capture
- T1125 Video Capture
- T1573.001 Symmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NanoCore VBScript Loader - wscript/cscript Spawning PowerShell or cmd (SPL)** (`TL-2026-4792-SPL-001`)

Detects Windows Script Host (wscript.exe/cscript.exe) spawning powershell.exe, pwsh.exe or cmd.exe, the hand-off used by the math-obfuscated (chr/CLng hex-decimal division) VBScript loader that delivers the NanoCore RAT in TL-2026-4792. Flags encoded/hidden/download PowerShell arguments and scripts launched from user-writable paths.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.005, T1059.001, T1059.003, T1027, T1140
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    (ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe")
    (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe")
| eval cmd=lower(CommandLine), parent_cmd=lower(ParentCommandLine)
| eval ps_suspicious=if(match(cmd,"(-enc|-encodedcommand|downloadstring|downloadfile|invoke-expression|iex\\s|frombase64string|-w(indowstyle)?\\s+hidden|-nop|-ep\\s+bypass|pastebin\\.com)"),1,0)
| eval vbs_user_path=if(match(parent_cmd,"\\\\(appdata|temp|downloads|users\\\\public)\\\\"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentCommandLine) as vbs_cmdline values(CommandLine) as child_cmdline max(ps_suspicious) as ps_suspicious max(vbs_user_path) as vbs_user_path by Computer, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| sort 0 -ps_suspicious -count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| extend PsSuspicious = ProcessCommandLine matches regex @"(?i)(-enc|-encodedcommand|downloadstring|downloadfile|invoke-expression|\biex\b|frombase64string|-w(indowstyle)?\s+hidden|-nop|-ep\s+bypass|pastebin\.com)"
| extend VbsUserPath = InitiatingProcessCommandLine matches regex @"(?i)\\(appdata|temp|downloads|users\\public)\\"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, PsSuspicious, VbsUserPath
| order by Timestamp desc
```

### Sigma

```yaml
title: Script Host Spawning PowerShell or Command Shell - NanoCore VBScript Loader
id: 6d0e4792-1a01-4b7c-8f31-5c2d9e7a0001
status: experimental
description: Detects wscript.exe or cscript.exe spawning powershell.exe, pwsh.exe or cmd.exe, the execution hand-off used by the math-obfuscated VBScript loader that delivers NanoCore (TL-2026-4792).
references:
    - https://www.embeeresearch.io/advanced-cyberchef-techniques-defeating-nanocore-obfuscation-with-math-and-flow-control/
    - https://attack.mitre.org/software/S0336/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1059.001
    - attack.t1059.003
    - attack.defense-evasion
    - attack.t1027
    - attack.t1140
    - attack.s0336
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate logon or admin scripts that call PowerShell from VBScript
    - Software deployment and inventory tooling using Windows Script Host
level: high

```

**Known false positives:**

- Legitimate logon scripts or admin automation that invoke PowerShell from VBScript
- Software deployment and inventory agents that use Windows Script Host

**Tuning notes:** Baseline parent script paths and allow-list signed enterprise scripts (by path or hash). Raise priority when ps_suspicious=1 or the script runs from AppData/Temp/Downloads. Hunt the sample SHA256 c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1 in file/mail telemetry separately. Requires Sysmon EventCode 1 (or MDE DeviceProcessEvents) with command-line capture.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- NanoCore VBScript Loader - wscript/cscript Spawning PowerShell or cmd (KQL) (locked: unlock with TL Creds)
- NanoCore Persistence - Run/RunOnce Key Launching VBScript (KQL) (locked: unlock with TL Creds)
- NanoCore C2 - RegSvcs/MSBuild/RegAsm Outbound and Related Infrastructure (KQL) (locked: unlock with TL Creds)
- NanoCore VBScript Loader - wscript/cscript Spawning PowerShell or cmd (Sigma) (locked: unlock with TL Creds)
- NanoCore Persistence - Run/RunOnce Key Launching VBScript (Sigma) (locked: unlock with TL Creds)
- NanoCore C2 - RegSvcs/MSBuild/RegAsm Outbound and Related Infrastructure (Sigma) (locked: unlock with TL Creds)
- NanoCore Persistence - Run/RunOnce Key Launching VBScript (SPL) (locked: unlock with TL Creds)
- NanoCore C2 - RegSvcs/MSBuild/RegAsm Outbound and Related Infrastructure (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 12)

Defanged, TLP:CLEAR.

- IP address: `216.170.114[.]4`
- Domain: `won2020[.]duckdns[.]org`
- File hash: `c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Advanced Cyberchef Techniques - Defeating Nanocore Obfuscation With Math and Flow Control](https://www.embeeresearch.io/advanced-cyberchef-techniques-defeating-nanocore-obfuscation-with-math-and-flow-control/)
- [MITRE ATT&CK: NanoCore (S0336)](https://attack.mitre.org/software/S0336/)
- [Zscaler: Multistage FreeDom loader used to spread Azorult and NanoCore RAT](https://www.zscaler.com/jp/blogs/security-research/multistage-freedom-loader-used-spread-azorult-and-nanocore-rat)
- [Morphisec: NanoCore RAT Under the Microscope](https://www.morphisec.com/?p=2979)
- [MalwareBazaar sample c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1](https://bazaar.abuse.ch/sample/c6092b1788722f82280d3dca79784556df6b8203f4d8f271c327582dd9dcf6e1/)
- [SOC Prime: Nanocore RAT Detection](https://socprime.com/blog/nanocore-rat-detection/)
- [Cofense: NanoCore coverage](https://cofense.com/?p=663)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4792