General

  • Target

    b54b41d8e1dec9884acb3da21ffeb8353a8acb8a53a4c30efa27c139a9ef0a92

  • Size

    1.7MB

  • Sample

    221230-brbp4sef66

  • MD5

    36316904a98e55072ae9362a62b2299d

  • SHA1

    6dd64f8c9c435c1c5911d9750463d8b789c9095a

  • SHA256

    27c6242052a41926d899f51e59828928be6896e09d14b73a9a7d008bdc695b7c

  • SHA512

    ada293be927ae024c24e1ecf96d104447bd4c506d16016cad381dbe2f86755efa3f1e272e277b35a15cc68ce616fbdda1f4f2d86ad018eb31dbb3484a96bf15c

  • SSDEEP

    49152:ehxB//gKWXIlimVIhcxgDFjFKg9JsDiJ4Q4+dtT9dF:ehL3gKWdSIPDFxPSDQ4+dtRj

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      b54b41d8e1dec9884acb3da21ffeb8353a8acb8a53a4c30efa27c139a9ef0a92

    • Size

      1.8MB

    • MD5

      0e5ddc4a80ccdb5d621cf855403a0f82

    • SHA1

      0d98053a54f7a1d3a263d0e9668e446973209ac7

    • SHA256

      b54b41d8e1dec9884acb3da21ffeb8353a8acb8a53a4c30efa27c139a9ef0a92

    • SHA512

      7896e08df48984674b93bbeb005cb386da511bb91f42466ce5fd8cf86866ee4414dd08e7d8045cbb530229d821d6f240012ae82b4ff63e0acddeaa32f6017271

    • SSDEEP

      49152:Bi9/6KenaLi+VsncnUvPjlK+9J8RIX444+Hth96j:BiN6Kej6sPvPJZOh44+HtHu

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks