Campaigns / Malware / Family

NanoCore

NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information.

5New IOCs · 24h
39New IOCs · 7 days
45Indicators tracked
3Independent feeds
2026-10-12 00:00Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

  • Hash34
  • TLS cert6
  • IP5
  • Malware39
  • C26

MITRE ATT&CK lists this as malware NanoCore. Explore the ATT&CK matrix →

Where its infrastructure is hosted

  1. 🇳🇴 Norway1
  2. 🇦🇺 Australia1
  3. 🇺🇸 United States1
  4. 🇫🇷 France1
  5. 🇳🇱 Netherlands1

Latest indicators

Filter the live feed →
First seenTypeIndicatorRoleWhere
2026-10-12 00:00SHA2565eb6513070383d331f1d7690bf0cec69be82786cda4c2e65ac0d938fcbc36cb8Malware sample—
2026-10-12 00:00SHA2566084d04942d79a30e426b464f2e88f5f7a69365f8b9b6429c7a1c7bcdf61a1ccMalware sample—
2026-10-11 17:20SHA2562d54bf055e8791b01f58eadb2926dd4ddad3646d6ebdd92073b6b29c5c8ec2deMalware sample—
2026-10-11 14:09SHA256cf41e9568da0e083fb7fabd6bf3b171a228d8d66381b2fad0994dfb09d2a1da7Malware sample—
2026-10-11 13:00SHA256b93e588ad9730abd74f04a59b1c668e0185b0b5098677aedb8cd94c2d2da133bMalware sample—
2026-10-11 07:02SHA2562b460a5754055eb7fd00227d7003d008e6134a36336fc59c36e35ef03d4d0fc9Malware sample—
2026-10-11 03:00SHA2565fbf33f268bf181d1da7d60020aa257180bb277c0a874d15d83efe2efcf1c5cbMalware sample—
2026-10-11 03:00IP194.5.98[.]26Contacted by malware—
2026-10-11 00:59SHA25620ed60ead14c798aa5ab6dd4ab3c2c2ac8d95a78ad89b84458ecb25e04274807Malware sample—
2026-10-11 00:59SHA2565d943e80dd93ce79e8d9f99da3f149835da13be2b09721182b60cc50c9c64132Malware sample—
2026-10-11 00:59SHA25665659d0e34ea78b4474f6038139cc1cffed661c61a8c5928286023be9c2b25a9Malware sample—
2026-10-10 17:46SHA256426cee0819cc33240281d4be0403120cef32dbe29e1a8ac4591497230566d6a5Malware sample—
2026-10-10 17:15SHA25638cac999881944e48e997877535b8cc653bc2b441e8e7e8eaa5773207848df72Malware sample—
2026-10-10 17:15SHA25640fb7fc74584eaa9452f2015a13b1b60a3cdc6f91723163a4932d499c5104a85Malware sample—
2026-10-10 17:15SHA2564100602c7467adba4afc4ef63d4377cff5c4d80f4ed5f27c975ac120b5d21c02Malware sample—
2026-10-10 17:00SHA2562e93e00302b32dbad05e498c82e5a58bf1a1907f2e239ee896b628994f06be4dMalware sample—
2026-10-10 17:00IP43.226.229[.]132Contacted by malware—
2026-10-10 16:43SHA2561c3ca672ac2c160025f96b1790db205dc9c3b4dccadd2db05880d0a588857aabMalware sample—
2026-10-10 16:43SHA256203f9d7d8c52ab4a31c5a3061d7b2a2de969648b54e5d323d7c147c182272b6dMalware sample—
2026-10-10 16:43SHA256252519ef97d0917a103fda6f8f5fb827198365f135612ace7f6bea8920a39319Malware sample—
2026-10-10 13:05SHA2569b4bfdddc2a1a59cf45915fd20f183afb6a255575bb646441d821622600cd223Malware sample—
2026-10-09 08:04SHA256245311b56fe86c3ebd892e7c5a7bd244d8eaec0283378c420cd6db40393c4624Malware sample—
2026-10-09 05:48SHA2563dca14349a274f66c4f12e522abc3edb0cb9085122194862a8324f2cd88ce32bMalware sample—
2026-10-09 05:48SHA2564d61ed7c5ba264c08489e05ef32d201b11e94703d012801ba3d0438f8c833362Malware sample—
2026-10-09 05:48IP158.101.117[.]24Contacted by malware—
2026-10-09 05:48IP178.32.224[.]116Contacted by malware—
2026-10-09 05:00SHA256d456ce5474b5d1eb8b2944d3d33855102b96740e741cb52a73e5ddcd442365c8Malware sample—
2026-10-09 04:02SHA25639e15de5630953f40f523753066f88db465369eb2a5ec2d234e8ccc6387a1c81Malware sample—
2026-10-08 03:01SHA25607514c9f983cc2502bc20de3a69e4e8a804d8ff537bc41f01c04c3678ce6df50Malware sample—
2026-10-07 02:33SHA25653327a42369948232da71444dc56592076ed7672fe57f98025e8036e3edf02ffMalware sample—
2026-10-07 01:18SHA2561bd14d6f81d8ce401613afcbdf0e1cc7974a194fa0d26bb90ea06a6dc8670257Malware sample—
2026-10-07 01:18SHA256be7804dafdf16c7cc0f99a24b2cd08f32cf6deff7e8eb1a0834b5bd5a75decb4Malware sample—
2026-10-06 22:04SHA256b44433d2f35e4ec9d90b01048178058642cb2061280135bb5de7c1a41d8ead8bMalware sample—
2026-10-06 17:33SHA256694d9706f186b353c6a46cd49b3b5405dc95b10d788cf3b5a9c866a869814728Malware sample—
2026-10-06 17:18SHA256ad1df8767d4c742fb6b940d5026562a3d1409629ecf2c580c743a0657001591fMalware sample—
2026-10-06 16:38IP140.82.57[.]249Contacted by malware—
2026-10-06 00:55SHA256176e3b8bb480955589c292be9e74c38fb08ba73046c3e3016597384337f95efeMalware sample—
2026-10-06 00:50SHA2564b204193a8b7165f99a401a2ab33505c5f3af565ec3a8340cbcbda15b1a2bb53Malware sample—
2026-10-05 18:30SHA25671145362a2382c5de9ed2f1a374b5e5dc2bf6b054da31f28ae911dd117cf11a3Malware sample—
2022-01-21 10:57TLS certfb3389b61b0e38560257a0fd76d5e0654b5b7ab6Botnet C2—
2021-12-27 07:43TLS cert06b099f47b2fcd9d7297b7c41f3639b433a81125Botnet C2—
2021-06-22 13:23TLS certb04537497c482e283f41f82c02ec81c67f43224cBotnet C2—
2021-06-11 14:42TLS cert8dc90d59f9c79274f128269febc4a3bc3da079d1Botnet C2—
2020-07-17 17:28TLS certb1c24828ee6174869f6852657a9dee6819850e08Botnet C2—
2020-06-26 17:45TLS certb21e502fab5b5d684d29b0ae73751eaf65384677Botnet C2—

Defanged for safety. URL query strings removed.