"value":"NanoCore is a Remote Access Tool (RAT) that's currently available for a $25 license [1]. However, like many other RATs, NanoCore has been used by criminal groups to take over Windows computers. Beta versions of NanoCore RAT have been available to criminals since 2013 [2], and a cracked full version was leaked last year in 2015 [3].\r\n\r\nSince then, the NanoCore RAT has been used in targeted phishing campaigns that are subtle and harder to detect [4]. Earlier this year, we saw it used in tax-themed emails as part of an increased distribution of the full-featured NanoCore RAT through phishing [5].\r\n\r\nSince then, I haven't noticed any public reporting on specific campaigns, even though I've noticed NanoCore RAT-based phishing emails on a near-daily basis. These recent emails don't seem subtle, and the vast majority of them are blocked. I consider these recent examples malicious spam (malspam). They either have attached zip archives containing an executable file, or they have attached Microsoft Office documents with malicious macros designed to download and execute the NanoCore RAT. One such malspam with a zip attachment was recently sent to my malware-traffic-analysis.net email address. That one was easily caught by my spam filter.\r\n\r\nDue to a relative lack of publicly-posted info on recent NanoCore RAT malspam campaigns, I thought I'd examine the email I received for today's dairy."
},
{
"category":"Payload delivery",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1477049480",
"to_ids":true,
"type":"email-attachment",
"uuid":"5809fc88-4394-4670-87ce-49c8950d210f",
"value":"TKP-PO 332-2016131023.zip"
},
{
"category":"Network activity",
"comment":"Examining the email headers, we find the email came from a mail server at ps1.700tb.com on 119.18.103.60.",
"comment":"Running the malware on a host in my lab environment gave me post-infection activity on 137.74.157.90 as encoded or encrypted traffic over TCP port 33338.",
"deleted":false,
"disable_correlation":false,
"timestamp":"1477049642",
"to_ids":true,
"type":"ip-dst",
"uuid":"5809fd2a-045c-4e1d-bc64-4997950d210f",
"value":"137.74.157.90"
},
{
"category":"Payload delivery",
"comment":"- Xchecked via VT: 69c32f18a33f922e253d39025e773211223c9af832314103410ca9eccf1a90f2",
