General

  • Target

    file.exe

  • Size

    2.2MB

  • Sample

    221120-sx2bdsab94

  • MD5

    d585fe26d4d4262954cc3a72d63a60c2

  • SHA1

    38c73aed20a6114fdba6ce5cfa80c8372acb6b35

  • SHA256

    364ea09e56e5ebbf066d1eb21653b88700852be12e6453ea222fb6a604e3d8e6

  • SHA512

    6ee19ba1bff17526e6ff4b33cc28936774713e4ac89737cbb41f19369ae736983a7a2194b26580d6b41bb6e411667588810d6c4380c181eedc1a262cd92e632c

  • SSDEEP

    49152:q241caYriJKMSw4Nkbpe0g6mYeUSnQ+VwWoeLUxVkBaFwnm:rhaYrirSDkbwcHBSkWRLUxVkB04m

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      file.exe

    • Size

      2.2MB

    • MD5

      d585fe26d4d4262954cc3a72d63a60c2

    • SHA1

      38c73aed20a6114fdba6ce5cfa80c8372acb6b35

    • SHA256

      364ea09e56e5ebbf066d1eb21653b88700852be12e6453ea222fb6a604e3d8e6

    • SHA512

      6ee19ba1bff17526e6ff4b33cc28936774713e4ac89737cbb41f19369ae736983a7a2194b26580d6b41bb6e411667588810d6c4380c181eedc1a262cd92e632c

    • SSDEEP

      49152:q241caYriJKMSw4Nkbpe0g6mYeUSnQ+VwWoeLUxVkBaFwnm:rhaYrirSDkbwcHBSkWRLUxVkB04m

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks