nanocore: d065ebea — VB.NET ConfuserEx sibling, NanoCore v1.2.2.0 RAT (hotro.exe)

Executive Summary

A 203 KB PE32 .NET assembly (hotro.exe) that is the third confirmed sibling in a NanoCore RAT client batch built on 22 Feb 2015. Same ConfuserEx obfuscation layer, same builder version (1.2.2.0), same modular plugin architecture, and same raw-TCP C2 pattern as fe81691f and 48c8e8a2. The only static deltas are the assembly GUID, the encrypted .rsrc payload, and the original filename. Static-only — CAPE Windows guest unavailable. ^[file.txt] ^[metadata.json]

What It Is

This sample is a sibling build from the same NanoCore builder batch as fe81691f and 48c8e8a2. The shared fingerprint (timestamp, size, section layout, version string, and mangled-name corpus) indicates all three were emitted by the same builder run or by the same operator re-running the builder with different settings. For the full family analysis see nanocore. ^[/intel/analyses/fe81691f199873bd5470c7beff9a52fdd6c1e03b80484e40b15ce040cde851b5.html]

How It Works

See the fe81691f deep-dive for the complete behavior narrative. The delta for this sample is minimal:

• Different GUID: c3f8b4dc-1342-42c6-8a66-ffbfe5d193a0 vs b4de0bbe-4fc1-4999-bc15-86136959e331 (fe81691f) and 6d372552-3ebe-40d9-9ac6-db2887e57715 (48c8e8a2). This is the auto-generated My.Application GUID produced by Visual Studio at compile time, confirming a separate build. ^[strings.txt:1624]
• Different encrypted payload: .rsrc section SHA-256 is 65eff1b1aa6507f3f92a4263ab11d6e611a8e8bcccaaea25ea0f13fd70773945 — unique across all three siblings, meaning the ConfuserEx-encrypted resource package (likely the builder-generated ClientSettings + plugin ZIP) is build-specific. ^[pefile.txt:132-136]
• Filename: hotro.exe vs okfun.exe and jp.exe — suggests the builder allows custom output names or the operator renamed post-build. The name "hotro" is Vietnamese for "support" or "assist", a plausible masquerade for a help-desk or support-tool social-engineering lure.

All other behaviors — VB.NET My.Application bootstrap, hidden ClientLoaderForm, raw TCP C2 with host-cache updates (AddHostEntry, RebuildHostCache), registry Run persistence, pipe-based plugin IPC (CreatePipe, PipeExists, PipeClosed), and MD5 hashing — are identical to the siblings and documented at nanocore and confuserex-obfuscation.

Decompiled Behavior

Radare2 CIL analysis finds the same entry-point signature: ClientLoaderForm.Main at 0x40c480, with 858 methods and a single mscoree.dll!_CorExeMain import. ^[rabin2-info.txt] ^[r2:entry0] The CIL engine reports the same ConfuserEx control-flow flattening and delegate trampolines that block clean decompilation. No new functions of interest were surfaced beyond those already catalogued in fe81691f.

C2 Infrastructure

• Static C2: None extracted. The encrypted .rsrc payload differs from both siblings, so any embedded host list is unique to this build. ^[pefile.txt:132-136]
• Protocol, persistence, and plugin IPC: Identical to fe81691f. See nanocore for the full mapping.

Interesting Tidbits

1. Third sibling confirms batch production: Three samples with the same compile-to-the-second timestamp, same size, and same version string strongly suggest they were produced by the same builder executable in rapid succession or by the same operator using the same builder package. ^[pefile.txt:34]
2. Filename shift to Vietnamese: hotro.exe ("support"/"assist" in Vietnamese) is a sharper social-engineering hook than the earlier okfun.exe or jp.exe. Targeting Vietnamese-speaking users or masquerading as a local support tool. ^[metadata.json]
3. P/Invoke surface unchanged: The same native API imports are present — SetThreadExecutionState, NtSetInformationProcess, QueryDosDevice, GetProcessImageFileName, RegOpenKeyEx, DnsQuery_A, and the standard kernel32.dll/advapi32.dll/ntdll.dll triad. ^[strings.txt:1381-1396]
4. No new YARA hits: Still only PE_File_Generic; the ConfuserEx layer defeats open-source NanoCore YARA rules. ^[yara.txt]
5. Builder version consistency: All three siblings stamp 1.2.2.0, an older build from the leaked-source era (~2014–2015). No evidence of post-leak fork modifications. ^[strings.txt:1626]

How To Mess With It (Homelab Replication)

See the replication notes in fe81691f. To reproduce this specific sibling:

1. Use the same NanoCore builder (v1.2.2.0) to generate three clients with different ClientSettings host entries.
2. Pass all three through ConfuserEx v1.6.0 with identical settings (name obfuscation, control flow, resource encryption).
3. Compare SHA-256s — they will differ only in .rsrc and the auto-generated My.Application GUID.
4. Rename outputs to okfun.exe, jp.exe, and hotro.exe to match the observed cluster.

Deployable Signatures

YARA — NanoCore ConfuserEx Sibling Detector (v3)

rule nanocore_confuserex_sibling_batch_v3
{
    meta:
        description = "NanoCore RAT client ConfuserEx variant — sibling batch detector"
        author      = "triage-auto"
        date        = "2026-06-11"
        sha256      = "d065ebea634c65f1bc3e1b770d09f0364b87a74a631deca80f84f20561533898"
    strings:
        $nano1 = "NanoCore Client" ascii wide
        $nano2 = "NanoCore.ClientPlugin" ascii wide
        $nano3 = "IClientApp" ascii wide
        $nano4 = "ClientLoaderForm" ascii wide
        $nano5 = "SendToServer" ascii wide
        $nano6 = "AddHostEntry" ascii wide
        $nano7 = "RebuildHostCache" ascii wide
        $nano8 = "PluginUninstalling" ascii wide
        $conf1 = /#=q[A-Za-z0-9_$]{20,}==/
        $conf2 = /#=q[A-Za-z0-9_$]{20,}=.*=/
        $vb1   = "MyTemplate" ascii wide
        $vb2   = "My.MyProject.Forms" ascii wide
    condition:
        uint16(0) == 0x5A4D
        and pe.number_of_sections == 3
        and any of ($nano*)
        and any of ($conf*)
        and any of ($vb*)
        and filesize < 500KB
}

Note: Syntactically tested by eye; deploy to your YARA sandbox before production. This rule also covers siblings fe81691f and 48c8e8a2.

Sigma — NanoCore Process Launch Hunt

title: NanoCore RAT Client Loader Execution
description: Detects NanoCore VB.NET client process based on module/interface strings and pipe creation.
logsource:
    category: process_creation
    product: windows
detection:
    selection_strings:
        CommandLine|contains|all:
            - 'NanoCore'
            - 'ClientLoaderForm'
    selection_pipes:
        CommandLine|contains:
            - 'PipeCreated'
            - 'PipeExists'
            - 'CreatePipe'
    selection_vb:
        ImageLoaded|contains:
            - 'Microsoft.VisualBasic'
            - 'MyTemplate'
    selection_mscoree:
        CommandLine|endswith:
            - '.exe'
    condition: 1 of selection_strings or (selection_pipes and selection_vb)
falsepositives:
    - Unknown
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.command_and_control
    - attack.t1071

IOC List

Behavioral Fingerprint

This binary is a .NET PE32 GUI assembly with a single mscoree.dll import. At startup it instantiates a hidden VB.NET WinForms client loader (ClientLoaderForm), initializes TCP socket objects (Socket, ConnectAsync, SendToServer), and maintains an internal C2 host cache (AddHostEntry, RebuildHostCache). It creates file-system directories and copies itself, interacts with the registry for persistence, and uses anonymous/named pipes for internal plugin IPC. Network traffic is raw TCP with keepalive framing (KeepAlive); no obfuscated HTTPS. The heavy ConfuserEx obfuscation (~1,000+ mangled #=q… identifiers) blocks naive string extraction and decompilation. The hotro.exe filename suggests a Vietnamese-language social-engineering lure masquerading as a support tool.

Detection Signatures (capa → ATT&CK)

capa static analysis already mapped capabilities to ATT&CK: ^[capa.txt]

Dynamic execution would likely surface additional TTPs such as T1547.001 (Registry Run Keys), T1059.001 (PowerShell), and T1021 (Remote Services) depending on builder configuration.

References

• SHA-256: d065ebea634c65f1bc3e1b770d09f0364b87a74a631deca80f84f20561533898
• Wiki entity: nanocore
• Wiki technique: confuserex-obfuscation
• Sibling analysis: /intel/analyses/fe81691f199873bd5470c7beff9a52fdd6c1e03b80484e40b15ce040cde851b5.html
• Sibling analysis: /intel/analyses/48c8e8a2f28318ae10000d4997784cd12703e182bd50db5da32b930034a0bc4c.html
• OpenCTI labels: nanocore, rat, malware-bazaar ^[metadata.json]
• Sample source: abuse.ch / MalwareBazaar (via OpenCTI urlhaus-recent-payloads connector)

Provenance

• Report built from static artefacts generated by the triage pipeline on 2026-05-26.
• Tools: file, strings, floss (failed — invalid args, no decoded strings), capa v5 (static, dotnet), binwalk, radare2 (CIL analysis, 858 functions), pefile.
• No CAPE dynamic analysis: Windows guest unavailable at time of triage. All runtime/C2 claims are inferred from static imports, capa capability map, and known NanoCore builder behavior.