Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-02 12:18:11 UTC
Home > List all groups > List all tools > List all groups using tool N1stAgent
 Tool: N1stAgent
Names N1stAgent
Category Malware
Type Backdoor
Description
(Palo Alto) N1stAgent requires specific arguments to execute successfully. Some samples
check only for one argument and others check for three different arguments where each one is
either executing the malware, sets a startup key and runs the malware or installs the malware
as a service. Service installation was not working in our found samples because the author
seems to be forgotten to install the service with arguments.
Information
Last change to this tool card: 20 April 2020
Download this tool card in JSON format
All groups using tool N1stAgent
Changed Name Country Observed
APT groups
 Reaper, APT 37, Ricochet Chollima, ScarCruft 2012-Mar 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1ac88c0e-5077-4ce2-b5bd-f1357ec6ae68
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1ac88c0e-5077-4ce2-b5bd-f1357ec6ae68
Page 1 of 1