NimbleMamba
Description
(Proofpoint) Each variant of TA402’s attack chain led to a RAR file containing one or multiple malicious compressed executables. These executables include a TA402 implant Proofpoint dubbed NimbleMamba and oftentimes an additional trojan Proofpoint named BrittleBush. NimbleMamba is almost certainly meant to replace LastConn, which Proofpoint reported about in June 2021.
NimbleMamba uses guardrails to ensure that all infected victims are within TA402’s target region. NimbleMamba uses the Dropbox API for both command and control as well as exfiltration. The malware also contains multiple capabilities designed to complicate both automated and manual analysis.
Names
| Name |
|---|
| NimbleMamba |
Category
Malware
Type
- Backdoor
- Info stealer
- Downloader
- Exfiltration
Information
Malpedia
Other Information
Uuid
1c33ff97-c5eb-4c51-a72e-31ad07abf8cd
Last Card Change
2022-12-27