nymaim

General

Target

50e028cead5a613978c91ced2d48c6c8.exe
Size

400KB
Sample

220906-ajgqqahcak
MD5

50e028cead5a613978c91ced2d48c6c8
SHA1

f9252a5702dbbffc82f9b6d9f133cdc2d1a91355
SHA256

2bf5be8c9b5e84d6eef09d6de968796a277ead7885cd96855f7637ddba987288
SHA512

2bec275606e8facd66645fe45c01505e7e23314d1763e4ba0df4371593bc504f22cf8056824597aa64acd1de93e56eaaefecbf9b3fc0466c9906a02478239a76
SSDEEP

6144:Nv0kF315GTFcbCW+Tnc5tjhAUcGIx0qa0Hv0CA02d0OyQR1N4GVU6M8qdS2vnTtz:Nv0a1j2Wj51lcK53U6CdSc2DLw

Score

10^/10

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes

payload_url
https://vipsofts.xyz/files/mega.bmp

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://microsoftdownload.ddns.net:8808/downloader/WinSecurityUpdate

Extracted

Family

redline

Botnet

nam8

C2

103.89.90.61:34589

Attributes

auth_value
20ca1b9206cb9e4c7251160fd51202e7

Extracted

Family

redline

Botnet

Clients

C2

18.130.38.218:42474

Attributes

auth_value
9879fc14e66bc6b79a905263bc0f0fad

Targets

- Target
  
  50e028cead5a613978c91ced2d48c6c8.exe
- Size
  
  400KB
- MD5
  
  50e028cead5a613978c91ced2d48c6c8
- SHA1
  
  f9252a5702dbbffc82f9b6d9f133cdc2d1a91355
- SHA256
  
  2bf5be8c9b5e84d6eef09d6de968796a277ead7885cd96855f7637ddba987288
- SHA512
  
  2bec275606e8facd66645fe45c01505e7e23314d1763e4ba0df4371593bc504f22cf8056824597aa64acd1de93e56eaaefecbf9b3fc0466c9906a02478239a76
- SSDEEP
  
  6144:Nv0kF315GTFcbCW+Tnc5tjhAUcGIx0qa0Hv0CA02d0OyQR1N4GVU6M8qdS2vnTtz:Nv0a1j2Wj51lcK53U6CdSc2DLw
Score

10^/10

nymaim privateloader redline evasion infostealer loader main persistence spyware stealer trojan clients nam8
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- NyMaim
  NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
  trojan nymaim
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2