S0336 - NanoCore

Name: S0336 - NanoCore
Creator: Maltiverse
Published: 2023-06-13

NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013

Author: agomez
Created: 2023-06-13 23:53:39
Last updated: 2026-02-07 18:03:30
Downloads: 347477
Hostname indicators: 2
URL indicators: 3
Sample indicators: 3613

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

0.tcp.ngrok.io Hostname

modified 2026-10-17 11:25:40
Malware Download (URLhaus Abuse.ch) · Nanocore RAT (ThreatFox Abuse.ch) · RedLine Stealer (ThreatFox Abuse.ch) · MSIL:Bladabindi (Hybrid-Analysis) · Dropped:Generic.Malware.SLlg (Hybrid-Analysis)

fitzi.io_chrome.exe Sample

modified 2026-10-17 11:18:35
Generic Malware (Hybrid-Analysis) · Nanocore (Triage) · Generic Malware (Maltiverse Threat Observatory)

210.204.137.38 IPv4

modified 2026-10-17 11:01:37
Mail Spammer (Abuseat.org) · Nanocore RAT (ThreatFox Abuse.ch) · DDoS attack (AbuseIPDB) · DNS Compromise (AbuseIPDB) · Phishing (AbuseIPDB)

cubanasrhtd.ddns.net Hostname

modified 2026-10-17 10:51:29
Nanocore RAT (ThreatFox Abuse.ch)

sample-d0a8340636fb.exe Sample

modified 2026-10-17 10:45:05
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

sample-5e3631144856.exe Sample

modified 2026-10-17 10:45:05
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

sample-e15bc1ef007c.exe Sample

modified 2026-10-17 10:45:05
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

sample-ab60730f052f.exe Sample

modified 2026-10-17 10:45:04
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

xoilac-tv.cheap_ransome.exe Sample

modified 2026-10-17 10:29:46
Nanocore (Triage)

xoilac-tv.cheap_new.exe Sample

modified 2026-10-17 10:29:08
Nanocore (Triage)

xoilac-tv.cheap_chrome.exe Sample

modified 2026-10-17 10:27:56
Nanocore (Triage)

xoilac-tv.blog_ransome.exe Sample

modified 2026-10-17 10:14:43
Nanocore (Triage)

xoilac-tv.blog_new.exe Sample

modified 2026-10-17 10:14:23
Nanocore (Triage)

tvcontinental.tv_ransome.exe Sample

modified 2026-10-17 09:41:43
Nanocore (Triage)

tvcontinental.tv_new.exe Sample

modified 2026-10-17 09:40:52
Nanocore (Triage)

livegorgeous.tv_ransome.exe Sample

modified 2026-10-17 09:35:25
Nanocore (Triage)

livegorgeous.tv_new.exe Sample

modified 2026-10-17 09:34:59
Nanocore (Triage)

massagin.co_ransome.exe Sample

modified 2026-10-17 09:30:05
Nanocore (Triage)

massagin.co_new.exe Sample

modified 2026-10-17 09:29:46
Nanocore (Triage)

massagin.co_chrome.exe Sample

modified 2026-10-17 09:28:16
Nanocore (Triage)

vsbet1-chrome.exe Sample

modified 2026-10-17 09:23:53
Nanocore (Triage)

cakhialink.info_ransome.exe Sample

modified 2026-10-17 08:55:28
Nanocore (Triage)

deez.zapto.org Hostname

modified 2026-10-17 08:41:48
Malicious Hostname (Cyber Threat Coalition) · Covid19 scam (Cyber Threat Coalition) · Nanocore RAT (ThreatFox Abuse.ch)

irofuuzo.ddns.net Hostname

modified 2026-10-17 08:41:38
Nanocore RAT (ThreatFox Abuse.ch)

smiggle.ddns.net Hostname

modified 2026-10-17 08:41:15
Nanocore RAT (ThreatFox Abuse.ch)

lamescape.no-ip.biz Hostname

modified 2026-10-17 08:41:04
Nanocore RAT (ThreatFox Abuse.ch)

hoanghuyen1527.ddns.net Hostname

modified 2026-10-17 08:40:42
Nanocore RAT (ThreatFox Abuse.ch)

nassiru1144.ddns.net Hostname

modified 2026-10-17 08:40:42
Nanocore RAT (ThreatFox Abuse.ch)

dave2h.ddns.net Hostname

modified 2026-10-17 08:40:42
Nanocore RAT (ThreatFox Abuse.ch)

blessed1234.duckdns.org Hostname

modified 2026-10-17 08:40:42
Nanocore RAT (ThreatFox Abuse.ch)

dera5nano.ddns.net Hostname

modified 2026-10-17 08:40:37
Nanocore RAT (ThreatFox Abuse.ch)

newsddawork.3utilities.com Hostname

modified 2026-10-17 08:40:30
Nanocore RAT (ThreatFox Abuse.ch)

socratecafu.hopto.org Hostname

modified 2026-10-17 08:40:24
Nanocore RAT (ThreatFox Abuse.ch)

toknowomo.duckdns.org Hostname

modified 2026-10-17 08:40:06
Nanocore RAT (ThreatFox Abuse.ch)

7.tcp.eu.ngrok.io Hostname

modified 2026-10-17 08:39:36
Nanocore RAT (ThreatFox Abuse.ch) · Malware (Hybrid-Analysis) · IL:Trojan.MSILZilla (Hybrid-Analysis) · Malicious URL (Hybrid-Analysis)

primaryjet.duckdns.org Hostname

modified 2026-10-17 08:39:36
Nanocore RAT (ThreatFox Abuse.ch) · Generic.Malware (Hybrid-Analysis) · Kryptik.RPA (Hybrid-Analysis)

ml.warzonedns.com Hostname

modified 2026-10-17 08:39:17
Nanocore RAT (ThreatFox Abuse.ch) · FileRepMalware (Hybrid-Analysis) · HEUR:Trojan.Kryptik (Hybrid-Analysis) · Trojan.Agent (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis)

internet-sullivan.gl.at.ply.gg Hostname

modified 2026-10-17 08:39:16
Nanocore RAT (ThreatFox Abuse.ch)

tracyll.ddns.net Hostname

modified 2026-10-17 08:39:13
Nanocore RAT (ThreatFox Abuse.ch)

nass1144.ddns.net Hostname

modified 2026-10-17 08:38:56
Nanocore RAT (ThreatFox Abuse.ch)

pc.charlito33.fr.nf Hostname

modified 2026-10-17 08:38:29
Nanocore RAT (ThreatFox Abuse.ch)

budapest.ydns.eu Hostname

modified 2026-10-17 08:38:20
Nanocore RAT (ThreatFox Abuse.ch)

southmoney.ddns.net Hostname

modified 2026-10-17 08:37:55
Nanocore RAT (ThreatFox Abuse.ch) · Gen:Variant.Ursu (Hybrid-Analysis)

blackhil.ddns.net Hostname

modified 2026-10-17 08:37:52
Nanocore RAT (ThreatFox Abuse.ch) · JS.Nemucod (Hybrid-Analysis) · Trojan.Generic (Hybrid-Analysis)

builderlloulirabaonline23rd.mywire.org Hostname

modified 2026-10-17 08:37:44
Nanocore RAT (ThreatFox Abuse.ch)

irenewoman.duckdns.org Hostname

modified 2026-10-17 08:37:43
Nanocore RAT (ThreatFox Abuse.ch)

progerok-53654.portmap.host Hostname

modified 2026-10-17 08:34:03
Nanocore (Cyber Threat Alliance)

2026-10-16_b8ad1f83c03394290cf2bf340b3c9411_destroyer_elex_glassworm_ngrbot_wannacry Sample

modified 2026-10-17 08:27:01
Nanocore (Triage)

cakhiatvrd.cc_ransome.exe Sample

modified 2026-10-17 08:24:38
Nanocore (Triage)

cakhiatvrd.cc_new.exe Sample

modified 2026-10-17 08:24:15
Nanocore (Triage)

cakhiatvrd.cc_chrome.exe Sample

modified 2026-10-17 08:21:54
Nanocore (Triage)

wfawiz82.hopto.org Hostname

modified 2026-10-17 08:15:10
Nanocore RAT (ThreatFox Abuse.ch) · Covid19 scam (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition)

N84.exe Sample

modified 2026-10-17 07:41:18
Nanocore (Triage)

N80x2.exe Sample

modified 2026-10-17 07:39:38
Nanocore (Triage)

N80.exe Sample

modified 2026-10-17 07:35:17
Nanocore (Triage)

2026-10-16_c75e1f7d428c5f177d4ffd9ad9ad6a00_destroyer_elex_glassworm_ngrbot_wannacry Sample

modified 2026-10-17 07:09:46
Nanocore (Triage)

xoilacczkn.tv_ransome.exe Sample

modified 2026-10-17 07:08:40
Nanocore (Triage)

xoilacczkn.tv_new.exe Sample

modified 2026-10-17 07:07:50
Nanocore (Triage)

cakhiatv.camp_ransome.exe Sample

modified 2026-10-17 07:01:44
Nanocore (Triage)

cakhiatv.camp_new.exe Sample

modified 2026-10-17 07:00:42
Nanocore (Triage)

sample-7b03f056f979.exe Sample

modified 2026-10-17 06:45:05
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

sample-fc045c073c36.exe Sample

modified 2026-10-17 06:45:05
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

sample-e3cd602c41b5.exe Sample

modified 2026-10-17 06:45:04
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

cakhia-tv.news_ransome.exe Sample

modified 2026-10-17 06:23:26
Nanocore (Triage)

cakhia-tv.news_new.exe Sample

modified 2026-10-17 06:21:29
Nanocore (Triage)

A853B7D874F5D7957DB8C44D1DF1A800.exe Sample

modified 2026-10-17 06:16:33
Nanocore (Triage) · NanoCore (MalwareBazaar Abuse.ch)

socolive66.co_chrome.exe Sample

modified 2026-10-17 06:13:45
Nanocore (Triage) · Generic Malware (Maltiverse Threat Observatory)

https://www.mediafire.com/download/xr9k7ga3i6zy3z5/NanoCore_1.2.2.0.rar URL

modified 2026-10-17 06:00:39
Nanocore (Triage)

flipvault.io_ransome.exe Sample

modified 2026-10-17 05:42:12
Nanocore (Triage)

socolive55.pro_ransome.exe Sample

modified 2026-10-17 05:35:37
Nanocore (Triage)

socolive55.pro_new.exe Sample

modified 2026-10-17 05:34:53
Nanocore (Triage)

cakhia1.cam_ransome.exe Sample

modified 2026-10-17 05:28:15
Nanocore (Triage)

cakhia1.cam_new.exe Sample

modified 2026-10-17 05:27:20
Nanocore (Triage)

takepisson.ydns.eu Hostname

modified 2026-10-17 05:26:37
Nanocore RAT (ThreatFox Abuse.ch)

kgentle77.duckdns.org Hostname

modified 2026-10-17 05:21:53
Nanocore RAT (ThreatFox Abuse.ch) · Trojan.Generic (Hybrid-Analysis)

safety-subcommittee.gl.at.ply.gg Hostname

modified 2026-10-17 05:21:53
Nanocore RAT (ThreatFox Abuse.ch)

bugodns.myddns.rocks Hostname

modified 2026-10-17 05:21:53
Nanocore RAT (ThreatFox Abuse.ch)

adelabbasenterprise.ddns.net Hostname

modified 2026-10-17 05:21:51
Nanocore RAT (ThreatFox Abuse.ch)

us3.localto.net Hostname

modified 2026-10-17 05:21:51
Nanocore RAT (ThreatFox Abuse.ch)

logshostinc55.hopto.org Hostname

modified 2026-10-17 05:21:50
Nanocore RAT (ThreatFox Abuse.ch)

cakhialink.art_ransome.exe Sample

modified 2026-10-17 05:21:18
Nanocore (Triage)

cakhialink.art_new.exe Sample

modified 2026-10-17 05:20:24
Nanocore (Triage)

xoilac66.fan_ransome.exe Sample

modified 2026-10-17 05:14:58
Nanocore (Triage)

xoilac66.fan_new.exe Sample

modified 2026-10-17 05:14:29
Nanocore (Triage)

cakhialink.wiki_ransome.exe Sample

modified 2026-10-17 05:09:36
Nanocore (Triage)

cakhialink.wiki_new.exe Sample

modified 2026-10-17 05:09:15
Nanocore (Triage)

globaldispatchespodcast.com_ransome.exe Sample

modified 2026-10-17 04:59:54
Nanocore (Triage)

globaldispatchespodcast.com_new.exe Sample

modified 2026-10-17 04:59:29
Nanocore (Triage)

ibidado1.hopto.org Hostname

modified 2026-10-17 04:40:32
Nanocore RAT (ThreatFox Abuse.ch)