ThreatFox: Nanocore RAT IOCs

Hunt Hypothesis

This hunt targets the presence of Nanocore RAT indicators, a remote access tool frequently used by threat actors to establish persistent, low-noise control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy intrusions before adversaries leverage the RAT for lateral movement or data exfiltration.

IOC Summary

Malware Family: Nanocore RAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["030e102f57811427fbeef4c6973d0fbb", "22833eb10882ee1d10cdf23b41339f3dc65b773921c9cde865dc92efe994910d", "a5cebb24af5b2281012cedd085fa5d65b33c6f5f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Nanocore RAT

False Positive Guidance

• Legacy Java Application Deployment: Enterprise Java applications (e.g., Spring Boot or Grails) often bundle the nanocore library or similar micro-frameworks for internal service communication. When deployed via CI/CD pipelines (e.g., Jenkins or Azure DevOps) to production servers, the presence of specific class files or JARs matching the IOC hash may trigger the rule.
  • Filter/Exclusion: Exclude paths under standard application directories such as C:\Program Files\Java\ or /opt/app/lib/ and filter for file extensions .jar or .class when the parent process is a known Java runtime (java.exe or java).
• Open Source Library Inclusion in Python Projects: Nanocore is sometimes used as a lightweight networking or utility library in internal Python-based data processing scripts or microservices. If these scripts are executed from shared network drives or user home directories during development or testing phases, the IOC files may be present in temporary or working directories.
  • Filter/Exclusion: Exclude files located in Python virtual environment directories (e.g., venv\, .venv\, site-packages\) or temporary directories (%TEMP%, /tmp/) when the initiating process is python.exe or python3.exe.
• Third-Party Development Tool Bundling: Certain IDEs or development tools (e.g., specific versions of IntelliJ IDEA plugins or custom build tools) may bundle Nanocore components for internal plugin communication or debugging features. These files are typically stored in user-specific application data folders.
  • Filter/Exclusion: Exclude paths under %APPDATA% or ~/.config/ for known development tools (e.g., JetBrains\, Code\) and filter for file names that match the IOC but are located within plugin or cache subdirectories.
• **Scheduled