nymaim

General

Target

Install.exe
Size

686.6MB
Sample

221009-ybrsqahggk
MD5

436c4290282bda086d3a38ae2ea5c2f5
SHA1

c69e9b7ba4967be00330053ba6b152f8393da612
SHA256

0fd1f535929f90d75a59c57a8b33e4fb40381bb7ee31b3c18c10cb7c8d6599a3
SHA512

ca1efea143c0e73b9c50afeaf0826da24373990c93b176f84e2576596b5296a38765db6710becab1c1829a5a1dba84eb34504f79ae0d55964a845e66a0aab15b
SSDEEP

98304:ULX0zHX9KZlxm8pNeRNO+eL1nZ779wnqRJh3kMDpzzY8:qXsHX9KmDJeLj9i4nda8

Score

10^/10

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes

payload_url
https://vipsofts.xyz/files/mega.bmp

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Extracted

Family

redline

Botnet

nam6.1

C2

103.89.90.61:34589

Attributes

auth_value
5a3c8b8880f6d03e2acaaa0ba12776e3

Extracted

Family

raccoon

Botnet

bd3a3a503834ef8e836d8a99d1ecff54

C2

http://135.148.104.11/

rc4.plain

Targets

- Target
  
  Install.exe
- Size
  
  686.6MB
- MD5
  
  436c4290282bda086d3a38ae2ea5c2f5
- SHA1
  
  c69e9b7ba4967be00330053ba6b152f8393da612
- SHA256
  
  0fd1f535929f90d75a59c57a8b33e4fb40381bb7ee31b3c18c10cb7c8d6599a3
- SHA512
  
  ca1efea143c0e73b9c50afeaf0826da24373990c93b176f84e2576596b5296a38765db6710becab1c1829a5a1dba84eb34504f79ae0d55964a845e66a0aab15b
- SSDEEP
  
  98304:ULX0zHX9KZlxm8pNeRNO+eL1nZ779wnqRJh3kMDpzzY8:qXsHX9KmDJeLj9i4nda8
Score

10^/10

nymaim privateloader raccoon redline smokeloader bd3a3a503834ef8e836d8a99d1ecff54 nam6.1 backdoor discovery evasion infostealer loader main persistence spyware stealer themida trojan vmprotect
- Detects Smokeloader packer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- NyMaim
  NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
  trojan nymaim
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2