General

  • Target

    b54b41d8e1dec9884acb3da21ffeb8353a8acb8a53a4c30efa27c139a9ef0a92

  • Size

    1.7MB

  • Sample

    221230-bb6kjshh5s

  • MD5

    bc483cf42f1ac4e9861a85b117ce2ba1

  • SHA1

    863d191937b444189473fa46779943e182bf8621

  • SHA256

    ce15ddcff84a0243ba5847cce906b3160debebe3624db2801fb037db297b18ed

  • SHA512

    1f3099293d129a19da01669dec81ae2c2f04e4e5836deba6a20df2544cb186049b412b19e441c0479b2a5380e93cfa0491817cb43f3f3bf65d34adbd6a7ebc25

  • SSDEEP

    49152:hhxB//gKWXIlimVIhcxgDFjFKg9JsDiJ4Q4+dtT9de:hhL3gKWdSIPDFxPSDQ4+dtRE

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      b54b41d8e1dec9884acb3da21ffeb8353a8acb8a53a4c30efa27c139a9ef0a92

    • Size

      1.8MB

    • MD5

      0e5ddc4a80ccdb5d621cf855403a0f82

    • SHA1

      0d98053a54f7a1d3a263d0e9668e446973209ac7

    • SHA256

      b54b41d8e1dec9884acb3da21ffeb8353a8acb8a53a4c30efa27c139a9ef0a92

    • SHA512

      7896e08df48984674b93bbeb005cb386da511bb91f42466ce5fd8cf86866ee4414dd08e7d8045cbb530229d821d6f240012ae82b4ff63e0acddeaa32f6017271

    • SSDEEP

      49152:Bi9/6KenaLi+VsncnUvPjlK+9J8RIX444+Hth96j:BiN6Kej6sPvPJZOh44+HtHu

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks