nanocore: 48c8e8a2 — VB.NET ConfuserEx sibling, NanoCore v1.2.2.0 RAT

Executive Summary

A 203 KB PE32 .NET assembly (jp.exe) that is a near-identical sibling of the NanoCore RAT client fe81691f. Same compilation timestamp (Feb 22 2015), same ConfuserEx obfuscation layer, same builder version (1.2.2.0), and same modular plugin architecture. The only static deltas are the assembly GUID, the encrypted resource payload, and the original filename. Static-only — no CAPE detonation. ^[file.txt] ^[metadata.json]

What It Is

This sample is a sibling build from the same NanoCore builder batch as fe81691f. The shared fingerprint (timestamp, size, section layout, version string, and mangled-name corpus) indicates both were emitted by the same builder run or by the same operator re-running the builder with different settings. For the full family analysis see nanocore. ^[/intel/analyses/fe81691f199873bd5470c7beff9a52fdd6c1e03b80484e40b15ce040cde851b5.html]

How It Works

See the fe81691f deep-dive for the complete behavior narrative. The delta for this sample is minimal:

• Different GUID: 6d372552-3ebe-40d9-9ac6-db2887e57715 vs b4de0bbe-4fc1-4999-bc15-86136959e331 in the sibling. This is the auto-generated My.Application GUID produced by Visual Studio at compile time, confirming a separate build. ^[strings.txt:1624]
• Different encrypted payload: .rsrc section hashes differ (SHA-256: f62bd278... vs 680ff063...), meaning the ConfuserEx-encrypted resource package (likely the builder-generated ClientSettings + plugin ZIP) is unique to this build. ^[pefile.txt:132-136]
• Filename: jp.exe vs okfun.exe — suggests the builder allows custom output names or the operator renamed post-build.

All other behaviors — VB.NET My.Application bootstrap, hidden ClientLoaderForm, raw TCP C2 with host-cache updates, registry Run persistence, pipe-based plugin IPC, and MD5 hashing — are identical to the sibling and documented at nanocore.

Decompiled Behavior

Radare2 analysis finds the same entry-point signature: ClientLoaderForm.Main at 0x40c480, with 858 methods and a single mscoree.dll!_CorExeMain import. ^[rabin2-info.txt] ^[r2:entry0] The CIL engine reports the same ConfuserEx control-flow flattening and delegate trampolines that block clean decompilation. No new functions of interest were surfaced beyond those already catalogued in fe81691f.

C2 Infrastructure

• Static C2: None extracted. The encrypted .rsrc payload differs from the sibling, so any embedded host list is unique to this build. ^[pefile.txt:132-136]
• Protocol, persistence, and plugin IPC: Identical to fe81691f. See nanocore for the full mapping.

Interesting Tidbits

1. Builder batch confirmation: Two samples with the same compile-to-the-second timestamp, same size, and same version string strongly suggest they were produced by the same builder executable in a single session or by the same operator using the same builder package. ^[pefile.txt]
2. Filename shift: jp.exe is shorter and more generic than okfun.exe. Possible masquerade as a Japanese-locale executable or simply a random short name chosen by the operator.
3. No new YARA hits: Still only PE_File_Generic; the ConfuserEx layer defeats open-source NanoCore YARA rules. ^[yara.txt]

How To Mess With It (Homelab Replication)

See the replication notes in fe81691f. To reproduce this specific sibling:

1. Use the same NanoCore builder (v1.2.2.0) to generate two clients with different ClientSettings host entries.
2. Pass both through ConfuserEx v1.6.0 with identical settings (name obfuscation, control flow, resource encryption).
3. Compare SHA-256s — they will differ only in .rsrc and the auto-generated My.Application GUID.

Deployable Signatures

YARA — NanoCore ConfuserEx Sibling Detector

rule nanocore_confuserex_sibling_batch
{
    meta:
        description = "NanoCore RAT client ConfuserEx variant — sibling batch detector"
        author      = "triage-auto"
        date        = "2026-06-11"
        sha256      = "48c8e8a2f28318ae10000d4997784cd12703e182bd50db5da32b930034a0bc4c"
    strings:
        $nano1 = "NanoCore Client" ascii wide
        $nano2 = "NanoCore.ClientPlugin" ascii wide
        $nano3 = "IClientApp" ascii wide
        $nano4 = "ClientLoaderForm" ascii wide
        $nano5 = "SendToServer" ascii wide
        $nano6 = "AddHostEntry" ascii wide
        $nano7 = "RebuildHostCache" ascii wide
        $conf1 = /#=q[A-Za-z0-9_$]{20,}==/
        $vb1   = "MyTemplate" ascii wide
        $ver   = "1.2.2.0" ascii wide
    condition:
        uint16(0) == 0x5A4D
        and pe.number_of_sections == 3
        and all of ($nano*)
        and any of ($conf*)
        and $vb1
        and $ver
        and filesize < 500KB
}

IOC List

Behavioral Fingerprint

Identical to fe81691f: .NET PE32 GUI assembly with single mscoree.dll import, hidden VB.NET WinForms loader, raw TCP socket C2 with keepalive framing, registry Run persistence, file-system self-copying, and pipe-based plugin IPC. ConfuserEx obfuscation (1,000+ mangled #=q… identifiers) blocks naive string extraction. The only deltas from the sibling build are the auto-generated GUID and the encrypted resource payload.

Detection Signatures (capa → ATT&CK)

capa static analysis mapped capabilities to ATT&CK: ^[capa.txt]

References

• SHA-256: 48c8e8a2f28318ae10000d4997784cd12703e182bd50db5da32b930034a0bc4c
• Sibling analysis: fe81691f199873bd5470c7beff9a52fdd6c1e03b80484e40b15ce040cde851b5 ^[raw/analyses/fe81691f.../report.md]
• Wiki entity: nanocore
• Wiki technique: confuserex-obfuscation
• Wiki procedure: registry-run-persistence
• OpenCTI labels: nanocore, rat, malware-bazaar ^[metadata.json]

Provenance

• Report built from static artefacts generated by the triage pipeline on 2026-05-26.
• Tools: file, strings, floss (no .NET support — 0 decoded strings), capa v5 (static, dotnet), binwalk, radare2 (CIL analysis, 858 functions), pefile, dnfile (assembly name/version extraction), diff (sibling comparison).
• No CAPE dynamic analysis: Windows guest unavailable. All runtime/C2 claims are inferred from static artefacts and known NanoCore builder behavior.