I came across a malicious executable that was dropped by a malicious script. The executable (let's call it malfile.exe) employs NanoCore, which is a modular RAT made up of DLL plugins written in .NET. malfile.exe is written in another language and it employs the plugins that are focused on spyware capabilities.

How should I classify malfile.exe in a report of its analysis? I do not work for a vendor so I don't need to use any convention but I'd like to avoid misleading naming. For example, "variant of NanoCore" does not seem suitable because the NanoCore components themselves are not changed in any previously unseen ways. Is "NanoCore based spyware" a correct way to describe malfile.exe?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.