General

  • Target

    file.exe

  • Size

    2.0MB

  • Sample

    221130-29qj4adg45

  • MD5

    f295138dab1a2153891fb0b041fe1efb

  • SHA1

    c7fba5e38e95b18122ee326838733a6f18c8faae

  • SHA256

    e9c2351a1382bdb2793af409a8a9cc3fb0507848ffc9052f7656b8fc94e36332

  • SHA512

    1c8c3010e28b204767be7c71ca06a34328abc97e60052e5d916ebd94243ff5cb08d88e1cb38770bc4ce975a6ba330ff05bac04a99e6bfdda1d88f27ceffea583

  • SSDEEP

    49152:0QMGfmJLBoknIGNOcXV6+M8OrEpG5ivl5rpOx8BRD8sAjeAG5cyz:0t2mJ9ok1ccXV6+eEpG+vroWB/AjeXcU

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      file.exe

    • Size

      2.0MB

    • MD5

      f295138dab1a2153891fb0b041fe1efb

    • SHA1

      c7fba5e38e95b18122ee326838733a6f18c8faae

    • SHA256

      e9c2351a1382bdb2793af409a8a9cc3fb0507848ffc9052f7656b8fc94e36332

    • SHA512

      1c8c3010e28b204767be7c71ca06a34328abc97e60052e5d916ebd94243ff5cb08d88e1cb38770bc4ce975a6ba330ff05bac04a99e6bfdda1d88f27ceffea583

    • SSDEEP

      49152:0QMGfmJLBoknIGNOcXV6+M8OrEpG5ivl5rpOx8BRD8sAjeAG5cyz:0t2mJ9ok1ccXV6+eEpG+vroWB/AjeXcU

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks