Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
RAT

NanoCore

RAT 30 detections found

Also known as: NanoCore RAT, Nancrat

NanoCore is a modular, .NET-based remote access trojan sold on underground forums since 2013, supporting plugins for keylogging, webcam/microphone capture, file management, and credential theft. Its developer, Taylor Huddleston, pleaded guilty in 2017 to U.S. federal charges for building and distributing the tool knowing it would be used to unlawfully access victims' computers, and was later sentenced to 33 months in prison. Despite the prosecution, leaked builder versions kept NanoCore in wide circulation; CISA listed it among the top malware strains observed in 2021.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
suricata ET MALWARE NanoCore RAT Keepalive Response 3 rev 7 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive Response 4 rev 3 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive 2 rev 3 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive 4 rev 4 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive 3 rev 4 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive Response 1 rev 11 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive 1 rev 3 2024-03-14
suricata ET MALWARE NanoCore RAT Keepalive Response 2 rev 11 2024-03-14
suricata ET MALWARE NanoCore RAT CnC 27 rev 3 2024-03-07
suricata ET MALWARE NanoCore RAT CnC 7 rev 2 2023-07-26
suricata ET MALWARE NanoCore RAT CnC 24 rev 2 2023-07-26
snort ET TROJAN NanoCore RAT Keepalive 2 rev 2 2023-07-26
snort ET TROJAN NanoCore RAT Keepalive Response 2 rev 10 2023-07-26
snort ET TROJAN NanoCore RAT Keepalive Response 3 rev 6 2023-07-26
snort ET TROJAN NanoCore RAT Keepalive 3 rev 3 2023-07-26
snort ET TROJAN NanoCore RAT CnC 7 rev 2 2023-07-26
snort ET TROJAN NanoCore RAT Keepalive Response 1 rev 10 2023-07-26
snort ET TROJAN NanoCore RAT CnC 24 rev 2 2023-07-26
suricata ET MALWARE NanoCore RAT CnC 23 rev 1 2023-07-26
snort ET TROJAN NanoCore RAT CnC 23 rev 1 2023-07-26
snort ET TROJAN NanoCore RAT Keepalive 1 rev 2 2023-07-26
snort ET TROJAN NanoCore RAT Keepalive 4 rev 3 2023-07-26
snort ET TROJAN NanoCore RAT Keepalive Response 4 rev 2 2023-07-26
snort ET TROJAN NanoCore RAT CnC 27 rev 3 2020-04-28
yara Nanocore_RAT_Sample_1 — —
yara Nanocore_RAT_Sample_2 — —
yara Nanocore_RAT_Gen_2 — —
yara Nanocore_RAT_Gen_1 — —
yara Nanocore — —
yara NanoCore — —