Severity
Medium
Analysis Summary
A Malspam campaign has been discovered distributing the Nanocore RAT Malware, a Remote Access Trojan that hides its presence for a long time by disabling the operation of an updated antivirus program. By generating fake alerts, it triggers and tricks users into installing the latest version of application software or virus protection software, meanwhile dropping harmful payloads in the registry editor. Once the user boots the system, the payloads are executed.
Many Malspam campaigns have been reported dropping the NanoCore RAT malware via MS Office documents, archives, etc. However, user action (clicking on attachments) is required for the infection to be successful.
Impact
Unauthorized Remote Access
Indicators of Compromise
IP(s) / Hostname(s)
- 184.75.209[.]163
- 185.163.45[.]48
URLs
- hxxp://testwork.kozow[.]com
Email Address
- ivona.rasic[@]superknjizara[.]hr
- noreply[@]fastpay[.]net
- ingodwetrust092[@]gmail[.]com
Malware Hash (MD5/SHA1/SH256)
- 812b23fd290cf4d50506b7509bce31ba
- 170146fa59c0982718a9b29521d1c7c7
- 3022ff8c4661ef35acea8a6dcf5a5fed
Remediation
- Block the threat indicators at their respective controls.
- Do not download/click on email attachments coming from untrusted sources.
- Always scan downloaded files prior to execution.