General

  • Target

    file.exe

  • Size

    1.2MB

  • Sample

    230111-gqwxjsaf24

  • MD5

    ecd7bbb7b2422c9b8a31167a82235249

  • SHA1

    368d616465255e47b30498032e21b182cc609228

  • SHA256

    fee7107573cfcab5d314ae9c55d43f03a35881f77b33ad1cd91283ea127c50e7

  • SHA512

    b86fdbe818af9d6b042d2862041c005a3f111a2d30069cb53cce18207126d9724526a64df63f05c222847d75bb0f21e4bdc87bd4cee71e3ebe142f1ebfd75b18

  • SSDEEP

    24576:q20I8HkTc0pgExiG6UrTJtXJFTmCSEVoEa3dihqnoE3jgXC75ld1qSVpk:q2lTc0Of9yTJtXJwC04S/3Hd1qapk

Score
10/10

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Targets

    • Target

      file.exe

    • Size

      1.2MB

    • MD5

      ecd7bbb7b2422c9b8a31167a82235249

    • SHA1

      368d616465255e47b30498032e21b182cc609228

    • SHA256

      fee7107573cfcab5d314ae9c55d43f03a35881f77b33ad1cd91283ea127c50e7

    • SHA512

      b86fdbe818af9d6b042d2862041c005a3f111a2d30069cb53cce18207126d9724526a64df63f05c222847d75bb0f21e4bdc87bd4cee71e3ebe142f1ebfd75b18

    • SSDEEP

      24576:q20I8HkTc0pgExiG6UrTJtXJFTmCSEVoEa3dihqnoE3jgXC75ld1qSVpk:q2lTc0Of9yTJtXJwC04S/3Hd1qapk

    Score
    10/10
    • NyMaim

      NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks