I came across a malicious executable that was dropped by a malicious script. The executable (let's call it
malfile.exe) employs NanoCore, which is a modular RAT made up of DLL plugins written in .NET.
malfile.exe is written in another language and it employs the plugins that are focused on spyware capabilities.
How should I classify
malfile.exe in a report of its analysis? I do not work for a vendor so I don't need to use any convention but I'd like to avoid misleading naming. For example, "variant of NanoCore" does not seem suitable because the NanoCore components themselves are not changed in any previously unseen ways. Is "NanoCore based spyware" a correct way to describe