NICECURL — Malware Profile

NICECURL is a VBScript-based backdoor used by APT42 to download additional modules.

MITRE ATT&CK techniques (5)

• T1059 Command and Scripting Interpreter
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1105 Ingress Tool Transfer
• T1573.002 Asymmetric Cryptography

Attributed threat actors

• APT42

Read the full analysis on IntelFusions