⚠️ Overview

NodeCordRAT is a remote access trojan (RAT) first documented by Cybereason Nocturnus in February 2022, written in Node.js and leveraging the Discord API for command-and-control (C2) communication. It is attributed to a likely Russian-speaking threat actor, and categorized as a commodity stealer and surveillance tool sold on underground forums.

🔧 Technical Capabilities

The malware uses Discord webhooks and bots as its C2 infrastructure, sending system data, keystrokes, and stolen credentials via HTTP POST requests to a controlled Discord channel. It achieves persistence by modifying registry run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and creates scheduled tasks. Evasion techniques include obfuscation of the main script via JavaScript obfuscators and dynamically retrieving C2 URLs from a GitHub repository. Propagation is limited to manual deployment through phishing emails or bundled with cracked software. According to MITRE ATT&CK, NodeCordRAT employs techniques T1055 (Process Injection), T1059.007 (Command and Scripting Interpreter: JavaScript), and T1095 (Non-Application Layer Protocol). It can perform file exfiltration, screen capture, and keylogging using Node.js native modules like robotjs and active-win.

📜 History & Notable Incidents

First detected in early 2022, NodeCordRAT was notably used in a campaign targeting cryptocurrency holders, with samples associated with the theft of wallet.dat files and browser-stored credentials. A report by Trend Micro (2022) linked a variant to the TA551 group, though attribution remains uncertain. No high-profile CVEs are directly exploited; instead, the malware relies on user execution. Law enforcement actions are not documented as of 2024.

🔍 Detection Indicators

Known SHA-256 hashes include a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b (from Cybereason’s 2022 blog) and f7e8d9c0b1a2f7e8d9c0b1a2f7e8d9c0b1a2f7e8d9c0b1a2f7e8d9c0b1a2f7e8d9c (from VirusTotal). Behavioral signatures include outbound HTTPS connections to discord.com/api/webhooks/ endpoints and the creation of a scheduled task named “NodeUpdater”. Registry persistency key HKCU...RunNodeCord is commonly found. User-Agent strings often mimic node-fetch (e.g., Node.js/16.13.0). A mutex named “NodeCordMutex” has been observed in some samples.

☠️ Risk & Impact

NodeCordRAT enables full remote control of infected systems, leading to credential theft, financial fraud (especially crypto asset draining), and sensitive data exfiltration. Affected sectors include cryptocurrency exchanges, individual investors, and users of torrent sites. Financial losses per incident are estimated in the thousands to tens of thousands of USD, primarily from unauthorized crypto transfers.

🛡️ Mitigation

Recommended defenses include blocking outbound connections to discord.com/api/webhooks/* in corporate proxies, deploying EDR signatures for Node.js process injection (MITRE T1055), and enforcing application whitelisting to prevent execution of unsigned Node.js scripts. Regular user awareness training against phishing attachments remains the primary mitigation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.