New Distribution of the NanoCore RAT

Zscaler ThreatLabZ provides a technical analysis of the NanoCore RAT: a multi-stage .NET-based malware that uses DES-CBC encryption and steganography (PNG resource) to load a NanoCore binary in memory. The report details distribution vectors (malicious documents, web downloads, spam), capabilities including credential theft, keylogging and remote execution, lists observed C2 domains and IOCs, and notes sandbox detections and monitoring actions.