Threat video1:00
NanoCore RAT Math-Obfuscated VBScript: Analysis & Hunting
Embee's math-based VBScript loader hides the NanoCore RAT payload, with 9 detection rules, 12 IOCs, 14 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for NanoCore RAT Math-Obfuscated VBScript: Analysis & Hunting →
Chapters
- 0:00The hookAbout 160 lines hide NanoCore in VBScript.
- 0:04The storyA September VBScript hid arithmetic.
- 0:11Attack pathVBScript, obfuscated with arithmetic division.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise10 indicators to hunt: 3 IPs, 1 domain and 1 SHA-256 hash, and more.
- 0:39MITRE ATT&CK techniques14 ATT&CK techniques, from execution to command and control.
- 0:44Remediation3 steps now: Block and hunt for the sample SHA256.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 160 lines hide NanoCore in VBScript.
0:05A September VBScript hid arithmetic.
0:07It delivers NanoCore, active since 2013.
0:12VBScript, obfuscated with arithmetic division.
0:15Decoded, it launches PowerShell.
0:17It harvests keystrokes and audio.
0:20Registry keys ensure persistence.
0:22Encrypted C2 channels enable control.
0:27No threat actor is attributed. Confidence: low.
0:3210 indicators to hunt: 3 IPs, 1 domain and 1 SHA-256 hash, and more.
0:4014 ATT&CK techniques, from execution to command and control.
0:443 steps now: Block and hunt for the sample SHA256.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.