{"id":1299,"date":"2021-03-15T15:50:56","date_gmt":"2021-03-15T10:20:56","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=1299"},"modified":"2021-06-07T11:00:42","modified_gmt":"2021-06-07T05:30:42","slug":"researchers-recognized-another-malware-written-in-nim-programming-language","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/","title":{"rendered":"Researchers Recognized Another Malware Written in Nim Programming Language!"},"content":{"rendered":"\n<p><p style=\"text-align: justify\">The security researcher discovered another email campaign that was initiated by the attackers while distributing the malware that was signed or written in Nim programming language.<\/p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What is Nim?<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify\">Nim is a statically typed and compiled programming language, it also combines the successful concepts from other mature languages like Python, Ada, and Modula. Whereas the hackers used this for making malware identified in the threat scene.<\/p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How this All Risen?<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify\">The main reason why these hackers choose a rare programming language, because they don\u2019t want to detect easily as reverse engineers are not aware of these rare languages called Nim and they are also focused on developing the detection for it. However, some tools and sandboxes maybe struggle to analyze the samples of it.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">Multiple organizations like Proofpoint are now tracking the operators from the campaign that works under the moniker TA800 and they also started distributing the NimzaLoader from 3rd February 2021, the latest activity TA800 is also used as BazaLoader from April 2020.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">Whereas the APT28 is also linked while delivering the Zebrocy malware the also used the Nim-based loaders, the appearance of NimzaLoader is also the sign that the hackers are constantly using the new tools of malware to avoid unwanted detection.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">In the case of BazaLoader, another campaign was also spotted on 3rd Feb that steals the user&#8217;s personalized emails with phishing techniques that contains the link of PDF document that simply redirected the users to the NimzaLoader executable page that was created on Slack, which displays a fake Adobe icon and uses social engineering attacks tricks while infecting the users.<\/p><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" loading=\"lazy\" width=\"728\" height=\"488\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/new-malware-spotted-nim-image.jpg\" alt=\"Researchers Recognized Another Malware Written in Nim Programming Language!\" class=\"wp-image-1300\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/new-malware-spotted-nim-image.jpg 728w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/new-malware-spotted-nim-image-300x201.jpg 300w\" sizes=\"(max-width: 728px) 100vw, 728px\" \/><\/figure><\/div>\n\n\n\n<p><p style=\"text-align: justify\">Once the users clicked on the malware, it will give the users data access to the hackers along with that the malware is capable to execute arbitrary commands that were retrieved from the C2 server and also deals with PowerShell commands execution, deploying additional malware, and injecting the shellcode into the running process.<\/p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Conclusion<\/strong><\/h2>\n\n\n\n<p><p style=\"text-align: justify\">Since the evidence founded by the law enforcement agencies also makes clear that NimzaLoader is also used while downloading and executing the Cobalt Strike as another payload and it also suggests the hackers targeted the users with the help of different tactics.<\/p><\/p>\n\n\n\n<p><p style=\"text-align: justify\">However, it is still unclear that if Nimzaloader is just a threat of the radar or it is some other attack, in case Nimzaloader will be operated by the attackers then they used the same way which was used by the BazaLaoder while spreading it.<\/p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The security researcher discovered another email campaign that was initiated by the attackers while distributing the malware that was signed or written in Nim programming language. What is Nim? Nim is a statically typed and compiled programming language, it also combines the successful concepts from other mature languages like Python, Ada, and Modula. Whereas the [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1302,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[15],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.11 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Researchers Recognized Another Malware Written in Nim Programming Language! - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Researchers Recognized Another Malware Written in Nim Programming Language! - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"The security researcher discovered another email campaign that was initiated by the attackers while distributing the malware that was signed or written in Nim programming language. What is Nim? Nim is a statically typed and compiled programming language, it also combines the successful concepts from other mature languages like Python, Ada, and Modula. Whereas the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-15T10:20:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-06-07T05:30:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/new-malware-spotted-nim-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"728\" \/>\n\t<meta property=\"og:image:height\" content=\"380\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"Researchers Recognized Another Malware Written in Nim Programming Language!\",\"datePublished\":\"2021-03-15T10:20:56+00:00\",\"dateModified\":\"2021-06-07T05:30:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/\"},\"wordCount\":414,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Infosec News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/\",\"url\":\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/\",\"name\":\"Researchers Recognized Another Malware Written in Nim Programming Language! - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-03-15T10:20:56+00:00\",\"dateModified\":\"2021-06-07T05:30:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Researchers Recognized Another Malware Written in Nim Programming Language!\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Researchers Recognized Another Malware Written in Nim Programming Language! - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/","og_locale":"en_US","og_type":"article","og_title":"Researchers Recognized Another Malware Written in Nim Programming Language! - Xiarch Solutions Private Limited","og_description":"The security researcher discovered another email campaign that was initiated by the attackers while distributing the malware that was signed or written in Nim programming language. What is Nim? Nim is a statically typed and compiled programming language, it also combines the successful concepts from other mature languages like Python, Ada, and Modula. Whereas the [&hellip;]","og_url":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-03-15T10:20:56+00:00","article_modified_time":"2021-06-07T05:30:42+00:00","og_image":[{"width":728,"height":380,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/03\/new-malware-spotted-nim-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"Researchers Recognized Another Malware Written in Nim Programming Language!","datePublished":"2021-03-15T10:20:56+00:00","dateModified":"2021-06-07T05:30:42+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/"},"wordCount":414,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Infosec News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/","url":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/","name":"Researchers Recognized Another Malware Written in Nim Programming Language! - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-03-15T10:20:56+00:00","dateModified":"2021-06-07T05:30:42+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/researchers-recognized-another-malware-written-in-nim-programming-language\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Researchers Recognized Another Malware Written in Nim Programming Language!"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/1299"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=1299"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/1299\/revisions"}],"predecessor-version":[{"id":1301,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/1299\/revisions\/1301"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/1302"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=1299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=1299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=1299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}