NimPlant - A Light-Weight First-Stage C2 Implant Written In Nim - RedPacket Security
Tags
| attack-pattern: | Data Powershell - T1059.001 Python - T1059.006 Rundll32 - T1218.011 Server - T1583.004 Server - T1584.004 Connection Proxy - T1090 Powershell - T1086 Rundll32 - T1085 Sudo - T1169 |
Common Information
| Type | Value |
|---|---|
| UUID | 0cce456b-1dcb-43ff-8437-57b2ef4e6aa1 |
| Fingerprint | 3918da5349860bb5 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | March 20, 2023, 10:01 p.m. |
| Added to db | March 20, 2023, 11:51 p.m. |
| Last updated | Nov. 17, 2024, 6:55 p.m. |
| Headline | RedPacket Security |
| Title | NimPlant - A Light-Weight First-Stage C2 Implant Written In Nim - RedPacket Security |
| Detected Hints/Tags/Attributes | 57/1/16 |
Source URLs
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 163 | ✔ | — | https://media.cert.europa.eu/rss?type=category&id=Malware&language=en&duplicates=false | 2024-08-30 22:08 |
| Details | 361 | ✔ | RedPacket Security | https://www.redpacketsecurity.com/feed/ | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 1 | nimplant.py |
|
| Details | Domain | 2 | notify.py |
|
| Details | Domain | 1 | build-ui.py |
|
| Details | File | 63 | vue.js |
|
| Details | File | 144 | requirements.txt |
|
| Details | File | 1 | nimplant.py |
|
| Details | File | 1 | nimplant.dll |
|
| Details | File | 1 | nimplant.db |
|
| Details | File | 312 | calc.exe |
|
| Details | File | 1 | notify.py |
|
| Details | File | 1 | build-ui.py |
|
| Details | File | 34 | next.js |
|
| Details | IPv4 | 1441 | 127.0.0.1 |
|
| Details | IPv4 | 619 | 0.0.0.0 |
|
| Details | Url | 1 | http://127.0.0.1:31337 |
|
| Details | Url | 4 | https://0.0.0.0:443 |