General

  • Target

    file.exe

  • Size

    2.2MB

  • Sample

    221228-jh4zascg71

  • MD5

    cb12a2cc70743960eea6e07d7e0d58fb

  • SHA1

    2ba5e1f98f1d2d69c6b03755c77e5a2f55b74638

  • SHA256

    4f03153062b00c79fd82ee0141580ecc58675e318eaa0b8f112c1241eb78e5b6

  • SHA512

    8edd3593e9d583d48710967bfdf422506b596e451300a90d9b6c41fdd99a8ebfccc0e50528196a21bc74fd43700baa133ab3a5affea025d58d04473ac8dea7a7

  • SSDEEP

    49152:6ivLILJgJ5BARMPxgXwo0NG/YoITTBs22tmQN3zGmgYECTGbKdWhnnmLUDXKK:6iv8NgJYbgREYr1Oku3z53ZTGWdQnnmg

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      file.exe

    • Size

      2.2MB

    • MD5

      cb12a2cc70743960eea6e07d7e0d58fb

    • SHA1

      2ba5e1f98f1d2d69c6b03755c77e5a2f55b74638

    • SHA256

      4f03153062b00c79fd82ee0141580ecc58675e318eaa0b8f112c1241eb78e5b6

    • SHA512

      8edd3593e9d583d48710967bfdf422506b596e451300a90d9b6c41fdd99a8ebfccc0e50528196a21bc74fd43700baa133ab3a5affea025d58d04473ac8dea7a7

    • SSDEEP

      49152:6ivLILJgJ5BARMPxgXwo0NG/YoITTBs22tmQN3zGmgYECTGbKdWhnnmLUDXKK:6iv8NgJYbgREYr1Oku3z53ZTGWdQnnmg

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks