General

  • Target

    file.exe

  • Size

    2.0MB

  • Sample

    221118-2z4nzabh98

  • MD5

    485eb5d1431c91f7a853af656ee44c85

  • SHA1

    ba12b1b5ffafe911629211659c78f7c6c3b26342

  • SHA256

    63eef020628e582267ca926bdcdc4f704fb163087abcca65af2777d61d4dc7d4

  • SHA512

    e5b4ccc932e5238d89c1a37d61e0d7a358b003f7bcd1df816733256489c88842e08e6214ddcf6547b6a3e1f4d3b1019d4c47324546f4901ac27551f5e12167bf

  • SSDEEP

    49152:q2DMJz63oS4eocrSsIWsFCD1Cjn7hcwHy2KqXDRFxyHfRx7Pq2:rPokaWsSOn7hccb7APD

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      file.exe

    • Size

      2.0MB

    • MD5

      485eb5d1431c91f7a853af656ee44c85

    • SHA1

      ba12b1b5ffafe911629211659c78f7c6c3b26342

    • SHA256

      63eef020628e582267ca926bdcdc4f704fb163087abcca65af2777d61d4dc7d4

    • SHA512

      e5b4ccc932e5238d89c1a37d61e0d7a358b003f7bcd1df816733256489c88842e08e6214ddcf6547b6a3e1f4d3b1019d4c47324546f4901ac27551f5e12167bf

    • SSDEEP

      49152:q2DMJz63oS4eocrSsIWsFCD1Cjn7hcwHy2KqXDRFxyHfRx7Pq2:rPokaWsSOn7hccb7APD

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks