{
  "family": "noancooe",
  "sample_count": 56,
  "category": "backdoor",
  "description": "Noancooe (cataloged across security vendors and threat intelligence databases under detections including Backdoor:MSIL/Noancooe, Trojan:Win32/Noancooe, and Backdoor.MSIL.Noancooe) is a stealthy .NET MSIL modular remote access trojan and backdoor active since 2018. Designed to grant threat actors persistent interactive control over compromised endpoints, Noancooe is frequently distributed disguised as cracked software utilities, software key generators, or malicious attachments within targeted spearphishing campaigns. Once executed, Noancooe establishes startup persistence through Windows Registry Run keys and scheduled tasks, performs host environment fingerprinting, and connects to remote command-and-control servers over encrypted TCP/HTTP channels. The backdoor provides attackers with capabilities to execute remote shell commands, harvest system credentials, log keystrokes, exfiltrate confidential files, and download secondary payloads such as ransomware or coinminers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:MSIL/Noancooe",
    "Trojan:Win32/Noancooe",
    "Backdoor.MSIL.Noancooe",
    "Win32/Noancooe",
    "Trojan.Noancooe"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:MSIL/Noancooe?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Noancooe is a .NET-based modular remote access trojan and backdoor that gives attackers remote control over infected Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Noancooe gain initial access to endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is commonly delivered through pirated software, cracked utilities, keygens, and malicious phishing email attachments."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious capabilities does Noancooe possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It can execute shell commands, capture keystrokes, steal files and browser credentials, and download secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Noancooe maintain persistence on Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates entries in Windows Registry Run keys and configures hidden scheduled tasks to execute at system boot."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders detect and remove Noancooe infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run an offline antimalware scan with Microsoft Defender, terminate suspicious .NET processes, and audit Registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1056.001",
    "T1555.003",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Pirated Software & Utility Cracks",
    "Malicious Phishing Email Attachments",
    "Deceptive Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Interactive Remote Shell Execution",
    "Credential Harvesting from Web Browsers",
    "Keystroke Logging (Keylogger)",
    "Secondary Payload Downloading",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      ".NET MSIL PE Executable",
      "Win32 Executable"
    ],
    "network_signatures": [
      "Encrypted TCP / HTTP C2 beaconing on non-standard high ports",
      "HTTP POST requests transmitting serialized host telemetry"
    ],
    "evasion_techniques": [
      "Process injection into legitimate system binaries (svchost.exe)",
      "Obfuscated .NET code protected with commercial packers"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "a19e48b3b42f2b3e449a57291dc8f781bb49f8b1",
      "5df726489312bcf8194ad9271649275819385920"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Noancooe",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NoancooeSvc"
    ],
    "file_paths": [
      "%AppData%\\Noancooe\\client.exe",
      "%Temp%\\noancooe_update.bin"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection and response (EDR) to monitor suspicious .NET process creation",
    "Block execution of unsigned executables from user %AppData% and %Temp% directories",
    "Audit Windows Registry Run keys and scheduled tasks regularly"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:MSIL/Noancooe",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:MSIL/Noancooe"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:MSIL/Noancooe!rfn",
      "Trojan:Win32/Noancooe.A"
    ]
  },
  "motivation": "Cyber espionage, Remote Endpoint Control & Initial Access Brokerage",
  "sample_hashes": []
}