General

  • Target

    63eef020628e582267ca926bdcdc4f704fb163087abcca65af2777d61d4dc7d4

  • Size

    2.0MB

  • Sample

    221119-dmnj8afa8s

  • MD5

    4fdb435ea238c0e48b14a3c134956793

  • SHA1

    6a7118e427d9676f64c1d4becf623cd4ec436bfd

  • SHA256

    acdbe2ef71b369156a7f115c2a49852f178e7112fc4f9d8d2915ac89cf3a1986

  • SHA512

    417758ff14e652a853a9b03ee75c76ec0952844506a8e3148f34a83ede04649152be68f4edbca8dc851074387027fec15cee7f00e29422fe0757c5c23d2ccdc0

  • SSDEEP

    49152:FMlP6log4eoQ1QES8ShCH1Cxz7tMSze2+mRDrltaHfRfTPem:roa+8SMez7tMehr4ln

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      63eef020628e582267ca926bdcdc4f704fb163087abcca65af2777d61d4dc7d4

    • Size

      2.0MB

    • MD5

      485eb5d1431c91f7a853af656ee44c85

    • SHA1

      ba12b1b5ffafe911629211659c78f7c6c3b26342

    • SHA256

      63eef020628e582267ca926bdcdc4f704fb163087abcca65af2777d61d4dc7d4

    • SHA512

      e5b4ccc932e5238d89c1a37d61e0d7a358b003f7bcd1df816733256489c88842e08e6214ddcf6547b6a3e1f4d3b1019d4c47324546f4901ac27551f5e12167bf

    • SSDEEP

      49152:q2DMJz63oS4eocrSsIWsFCD1Cjn7hcwHy2KqXDRFxyHfRx7Pq2:rPokaWsSOn7hccb7APD

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks