Researchers at Symantec have found a new and upcoming RAT (Remote Access Tool), which is freely available in black market and cybercriminals are ready to do their hands dirty using it to the fullest. The latest RAT called NanoCore, identified as Trojan.Nancrat by Norton, was previously available in underground market at a Price of 25 USD. But a report reveals that the a cracked version of the NanoCore RAT is now available freely.

Symantec emphasised on "humans tendency to incline towards FREE things". Hackers or Crackers we say, or specifically speaking the bad actors who are involved in cybercrimes - the cybercriminals, are also humans, and hence this fact applies to the same.

The Target

On the Hitlist of NanoCore RAT authors seems to be is the Energy Sector. Earlier this month when the full version of NanoCore (1.2.2.0) was leaked, it again showed a rise in increase of its usage. The RAT is found to be wildly exported in the Cyberspace area touching normal users with the use of simple Email Trick to lure user download the trojan file, ending in compromise of security and privacy.

"One example we came across of NanoCore being used in a targeted attack involved a spam run that started on March 6. The targeted emails are being sent to energy companies in Asia and the Middle East and the cybercriminals behind the attack are spoofing the email address of a legitimate oil company in South Korea. Attached to the email is a malicious RTF file that exploits the Microsoft Windows Common Controls ActiveX Control Remote Code Execution Vulnerability (CVE-2012-0158) and drops Trojan.Nancrat.", the report detailed.

Detections Worldwide

Symantec released a beautiful Infographic mentioning the detections of NanoCore RAT Worldwide over different versions of the cracked NanoCore RAT released. NanoCore detections are not confined to specific geographical regions but cover countries right across the globe

The Timeline

It was noticed, each time the author tries to develop and improve NanoCore, one of the customers invariably ends up leaking a copy of it for free. This surely has to be a major disincentive for the original developer but they seem to possess endless optimism and persist to create new versions with enhanced capabilities, maybe in the hope that eventually enough customers will pay.

The above graph clearly depicts the rise in the use of NanoCore RAT over the past months with the release of its cracked versions. This can be seen following the multiple leaks of version 1.0.3.0 in March and April, version 1.1.0.7 in July and August, version 1.1.0.10 in October, and finally the most recent leak of version 1.2.2.0 in March.

Talking about the future of the RAT, Symantec researchers expect more detections in the coming weeks due to a latest leak of the full version. As earlier said, the cracked version is available freely on visible web, surpassing the limits of dark web.

"That means its not just the more experienced cybercriminals who can easily access this malware for free, but also script kiddies eager to start their cybercriminal careers. The more the NanoCore malware is used and is visible on the underground, the higher the chances that one day it may end up just as well-known as some of the notorious RATs that have come before it. The question is, will the developer make the money that they intended to in developing NanoCore or does success only comes at the expense of lost revenue due to piracy?" questions the report.

Antivirus Detections

• Trojan.Nancrat
• Trojan.Gen
• Suspicious.Cloud.9
• Trojan.Mdropper
• Bloodhound.Exploit.457

Gateway Protection as suggested by Symantec

• Exploit/CVE-2012-0158
• Trojan.Gen