SYMBOLCOMMON_NAMEaka. SYNONYMS
win.nymaim (Back to overview)

Nymaim

aka: nymain
URLhaus      

Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.

References
2022-09-15SekoiaThreat & Detection Research Team
@online{team:20220915:privateloader:d88c7b2, author = {Threat & Detection Research Team}, title = {{PrivateLoader: the loader of the prevalent ruzki PPI service}}, date = {2022-09-15}, organization = {Sekoia}, url = {https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/}, language = {English}, urldate = {2022-09-19} } PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2021-02-08Lawfare BlogDavid Hechler
@online{hechler:20210208:what:f742cf1, author = {David Hechler}, title = {{What Is the Point of These Nation-State Indictments?}}, date = {2021-02-08}, organization = {Lawfare Blog}, url = {https://www.lawfareblog.com/what-point-these-nation-state-indictments}, language = {English}, urldate = {2021-02-18} } What Is the Point of These Nation-State Indictments?
Gameover P2P Nymaim
2019-05-16The Shadowserver FoundationThe Shadowserver Foundation
@online{foundation:20190516:goznym:37cf686, author = {The Shadowserver Foundation}, title = {{Goznym Indictments – action following on from successful Avalanche Operations}}, date = {2019-05-16}, organization = {The Shadowserver Foundation}, url = {https://www.shadowserver.org/news/goznym-indictments-action-following-on-from-successful-avalanche-operations/}, language = {English}, urldate = {2020-01-10} } Goznym Indictments – action following on from successful Avalanche Operations
Nymaim
2019-05-16Department of JusticeOffice of Public Affairs
@online{affairs:20190516:goznym:714f938, author = {Office of Public Affairs}, title = {{GozNym Cyber-Criminal Network Operating out of Europe Targeting American Entities Dismantled in International Operation}}, date = {2019-05-16}, organization = {Department of Justice}, url = {https://www.justice.gov/opa/pr/goznym-cyber-criminal-network-operating-out-europe-targeting-american-entities-dismantled}, language = {English}, urldate = {2020-01-08} } GozNym Cyber-Criminal Network Operating out of Europe Targeting American Entities Dismantled in International Operation
Nymaim
2019-05-16SecurityIntelligenceLimor Kessem
@online{kessem:20190516:goznym:cb4a177, author = {Limor Kessem}, title = {{GozNym Closure Comes in the Shape of a Europol and DOJ Arrest Operation}}, date = {2019-05-16}, organization = {SecurityIntelligence}, url = {https://securityintelligence.com/posts/goznym-closure-comes-in-the-shape-of-a-europol-and-doj-arrest-operation/}, language = {English}, urldate = {2019-12-05} } GozNym Closure Comes in the Shape of a Europol and DOJ Arrest Operation
Nymaim
2019-03-12ProofpointGeorgi Mladenov
@online{mladenov:20190312:nymaim:c35a90d, author = {Georgi Mladenov}, title = {{Nymaim config decoded}}, date = {2019-03-12}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/nymaim-config-decoded}, language = {English}, urldate = {2019-12-20} } Nymaim config decoded
Nymaim
2019-01-18Github (coldshell)Coldshell
@online{coldshell:20190118:nymaim:1d2e6f9, author = {Coldshell}, title = {{Nymaim deobfuscation}}, date = {2019-01-18}, organization = {Github (coldshell)}, url = {https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim}, language = {English}, urldate = {2020-01-10} } Nymaim deobfuscation
Nymaim
2017-01-30CERT.PLJarosław Jedynak
@online{jedynak:20170130:nymaim:d5553e6, author = {Jarosław Jedynak}, title = {{Nymaim revisited}}, date = {2017-01-30}, organization = {CERT.PL}, url = {https://www.cert.pl/en/news/single/nymaim-revisited/}, language = {English}, urldate = {2020-01-09} } Nymaim revisited
Nymaim
2016-11-02Ariel Koren's BlogAriel Koren
@online{koren:20161102:nymaim:26e076d, author = {Ariel Koren}, title = {{Nymaim Malware: Deep Technical Dive – Adventures in Evasive Malware}}, date = {2016-11-02}, organization = {Ariel Koren's Blog}, url = {https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/}, language = {English}, urldate = {2020-01-08} } Nymaim Malware: Deep Technical Dive – Adventures in Evasive Malware
Nymaim
2016-09-14DeloitteDeloitte
@techreport{deloitte:20160914:evolution:67ad556, author = {Deloitte}, title = {{The evolution of the Nymaim Criminal Enterprise Threat Intelligence & Analytics}}, date = {2016-09-14}, institution = {Deloitte}, url = {https://www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-aers-the-evolution-of-the-nymaim-criminal-enterprise.pdf}, language = {English}, urldate = {2022-03-28} } The evolution of the Nymaim Criminal Enterprise Threat Intelligence & Analytics
Nymaim
2016-04-14SecurityIntelligenceLimor Kessem, Lior Keshet
@online{kessem:20160414:meet:16351ef, author = {Limor Kessem and Lior Keshet}, title = {{Meet GozNym: The Banking Malware Offspring of Gozi ISFB and Nymaim}}, date = {2016-04-14}, organization = {SecurityIntelligence}, url = {https://securityintelligence.com/meet-goznym-the-banking-malware-offspring-of-gozi-isfb-and-nymaim/}, language = {English}, urldate = {2020-01-06} } Meet GozNym: The Banking Malware Offspring of Gozi ISFB and Nymaim
ISFB Nymaim GozNym
2016-02-26ProofpointProofpoint Staff
@online{staff:20160226:nymaim:a5904b2, author = {Proofpoint Staff}, title = {{Nymaim Moves Past Its Ransomware Roots - What Is Old Is New Again}}, date = {2016-02-26}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/what-old-new-again-nymaim-moves-past-its-ransomware-roots-0}, language = {English}, urldate = {2020-06-10} } Nymaim Moves Past Its Ransomware Roots - What Is Old Is New Again
Nymaim
2014-11-04BitBucketDaniel Plohmann
@online{plohmann:20141104:idapatchwork:db14073, author = {Daniel Plohmann}, title = {{IDApatchwork Repository}}, date = {2014-11-04}, organization = {BitBucket}, url = {https://bitbucket.org/daniel_plohmann/idapatchwork}, language = {English}, urldate = {2020-01-09} } IDApatchwork Repository
Nymaim
2014Fraunhofer FKIEDaniel Plohmann
@techreport{plohmann:2014:patchwork:4d0d260, author = {Daniel Plohmann}, title = {{Patchwork: Stitching against malware families with IDA Pro}}, date = {2014}, institution = {Fraunhofer FKIE}, url = {https://public.gdatasoftware.com/Web/Landingpages/DE/GI-Spring2014/slides/004_plohmann.pdf}, language = {English}, urldate = {2020-01-09} } Patchwork: Stitching against malware families with IDA Pro
Nymaim
Yara Rules
[TLP:WHITE] win_nymaim_auto (20230125 | Detects win.nymaim.)
rule win_nymaim_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.nymaim."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 89d8 01c8 31d2 f7f7 }
            // n = 4, score = 1800
            //   89d8                 | mov                 eax, ebx
            //   01c8                 | add                 eax, ecx
            //   31d2                 | xor                 edx, edx
            //   f7f7                 | div                 edi

        $sequence_1 = { 09c0 0f94c1 09c8 6bc064 09c0 }
            // n = 5, score = 1700
            //   09c0                 | or                  eax, eax
            //   0f94c1               | sete                cl
            //   09c8                 | or                  eax, ecx
            //   6bc064               | imul                eax, eax, 0x64
            //   09c0                 | or                  eax, eax

        $sequence_2 = { 31d2 f7f7 92 31d2 bf64000000 }
            // n = 5, score = 1700
            //   31d2                 | xor                 edx, edx
            //   f7f7                 | div                 edi
            //   92                   | xchg                eax, edx
            //   31d2                 | xor                 edx, edx
            //   bf64000000           | mov                 edi, 0x64

        $sequence_3 = { c1e902 740d 8b06 8907 83c704 }
            // n = 5, score = 1600
            //   c1e902               | shr                 ecx, 2
            //   740d                 | je                  0xf
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   8907                 | mov                 dword ptr [edi], eax
            //   83c704               | add                 edi, 4

        $sequence_4 = { c1e105 01c8 c1c307 30c3 }
            // n = 4, score = 1600
            //   c1e105               | shl                 ecx, 5
            //   01c8                 | add                 eax, ecx
            //   c1c307               | rol                 ebx, 7
            //   30c3                 | xor                 bl, al

        $sequence_5 = { 31c9 38f0 83d100 38d0 83d900 c1e105 }
            // n = 6, score = 1600
            //   31c9                 | xor                 ecx, ecx
            //   38f0                 | cmp                 al, dh
            //   83d100               | adc                 ecx, 0
            //   38d0                 | cmp                 al, dl
            //   83d900               | sbb                 ecx, 0
            //   c1e105               | shl                 ecx, 5

        $sequence_6 = { bf64000000 f7f7 5b 5f }
            // n = 4, score = 1600
            //   bf64000000           | mov                 edi, 0x64
            //   f7f7                 | div                 edi
            //   5b                   | pop                 ebx
            //   5f                   | pop                 edi

        $sequence_7 = { c1eb13 331d???????? 31c3 c1e808 }
            // n = 4, score = 1600
            //   c1eb13               | shr                 ebx, 0x13
            //   331d????????         |                     
            //   31c3                 | xor                 ebx, eax
            //   c1e808               | shr                 eax, 8

        $sequence_8 = { 00d3 8a16 301e 46 01fb }
            // n = 5, score = 1300
            //   00d3                 | add                 bl, dl
            //   8a16                 | mov                 dl, byte ptr [esi]
            //   301e                 | xor                 byte ptr [esi], bl
            //   46                   | inc                 esi
            //   01fb                 | add                 ebx, edi

        $sequence_9 = { f7e0 0fc8 01d0 894704 }
            // n = 4, score = 1100
            //   f7e0                 | mul                 eax
            //   0fc8                 | bswap               eax
            //   01d0                 | add                 eax, edx
            //   894704               | mov                 dword ptr [edi + 4], eax

        $sequence_10 = { 8b4e08 014e04 8b5e0c 015e08 }
            // n = 4, score = 1100
            //   8b4e08               | mov                 ecx, dword ptr [esi + 8]
            //   014e04               | add                 dword ptr [esi + 4], ecx
            //   8b5e0c               | mov                 ebx, dword ptr [esi + 0xc]
            //   015e08               | add                 dword ptr [esi + 8], ebx

        $sequence_11 = { c1e808 31c3 895e0c 89d8 01c8 }
            // n = 5, score = 1100
            //   c1e808               | shr                 eax, 8
            //   31c3                 | xor                 ebx, eax
            //   895e0c               | mov                 dword ptr [esi + 0xc], ebx
            //   89d8                 | mov                 eax, ebx
            //   01c8                 | add                 eax, ecx

        $sequence_12 = { 8b12 8b4d0c 8b5d18 8b1b 4f 31c0 fec2 }
            // n = 7, score = 1100
            //   8b12                 | mov                 edx, dword ptr [edx]
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b5d18               | mov                 ebx, dword ptr [ebp + 0x18]
            //   8b1b                 | mov                 ebx, dword ptr [ebx]
            //   4f                   | dec                 edi
            //   31c0                 | xor                 eax, eax
            //   fec2                 | inc                 dl

        $sequence_13 = { 8b06 c1e00b 3306 8b5604 0116 }
            // n = 5, score = 1100
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   c1e00b               | shl                 eax, 0xb
            //   3306                 | xor                 eax, dword ptr [esi]
            //   8b5604               | mov                 edx, dword ptr [esi + 4]
            //   0116                 | add                 dword ptr [esi], edx

        $sequence_14 = { 55 89e5 83ec10 8b4508 8d0d3430d201 }
            // n = 5, score = 100
            //   55                   | push                ebp
            //   89e5                 | mov                 ebp, esp
            //   83ec10               | sub                 esp, 0x10
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d0d3430d201         | lea                 ecx, [0x1d23034]

        $sequence_15 = { 4189c6 e8???????? c605????????5e b9c75b662d 89c5 e8???????? c605????????80 }
            // n = 7, score = 100
            //   4189c6               | inc                 ecx
            //   e8????????           |                     
            //   c605????????5e       |                     
            //   b9c75b662d           | pop                 esp
            //   89c5                 | pop                 edi
            //   e8????????           |                     
            //   c605????????80       |                     

        $sequence_16 = { 53 56 57 83ec44 8b4508 8d0d2030d201 }
            // n = 6, score = 100
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   83ec44               | sub                 esp, 0x44
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d0d2030d201         | lea                 ecx, [0x1d23020]

        $sequence_17 = { 44894530 4889f1 4c8d4538 e8???????? 8b4d40 89c8 8b5d48 }
            // n = 7, score = 100
            //   44894530             | sub                 esp, 0x20
            //   4889f1               | xor                 ebx, ebx
            //   4c8d4538             | inc                 esp
            //   e8????????           |                     
            //   8b4d40               | mov                 esi, ecx
            //   89c8                 | dec                 ebp
            //   8b5d48               | mov                 edi, eax

        $sequence_18 = { 4829c1 894db4 c1e902 83f900 0f8406000000 01d3 ffc9 }
            // n = 7, score = 100
            //   4829c1               | inc                 ecx
            //   894db4               | cmp                 ecx, 1
            //   c1e902               | je                  0x3cf06
            //   83f900               | dec                 eax
            //   0f8406000000         | sub                 ecx, eax
            //   01d3                 | mov                 dword ptr [ebp - 0x4c], ecx
            //   ffc9                 | shr                 ecx, 2

        $sequence_19 = { 56 83ec28 8b450c 8b4d08 8d154e30d201 }
            // n = 5, score = 100
            //   56                   | push                esi
            //   83ec28               | sub                 esp, 0x28
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8d154e30d201         | lea                 edx, [0x1d2304e]

        $sequence_20 = { 5b 5d c3 8b45f0 8b0c850440d201 }
            // n = 5, score = 100
            //   5b                   | pop                 ebx
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   8b0c850440d201       | mov                 ecx, dword ptr [eax*4 + 0x1d24004]

        $sequence_21 = { 448935???????? e8???????? b9975b662d 8944247c e8???????? b9895b662d 894580 }
            // n = 7, score = 100
            //   448935????????       |                     
            //   e8????????           |                     
            //   b9975b662d           | push                esi
            //   8944247c             | inc                 ecx
            //   e8????????           |                     
            //   b9895b662d           | push                edi
            //   894580               | dec                 eax

        $sequence_22 = { 4155 4156 4157 4883ec20 31db 4489ce 4d89c7 }
            // n = 7, score = 100
            //   4155                 | cmp                 ecx, 0
            //   4156                 | je                  0x12
            //   4157                 | add                 ebx, edx
            //   4883ec20             | dec                 ecx
            //   31db                 | inc                 ecx
            //   4489ce               | push                ebp
            //   4d89c7               | inc                 ecx

        $sequence_23 = { 31d2 890c24 c744240400000000 8945f4 8955f0 e8???????? 8d0d8630d201 }
            // n = 7, score = 100
            //   31d2                 | xor                 edx, edx
            //   890c24               | mov                 dword ptr [esp], ecx
            //   c744240400000000     | mov                 dword ptr [esp + 4], 0
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   8955f0               | mov                 dword ptr [ebp - 0x10], edx
            //   e8????????           |                     
            //   8d0d8630d201         | lea                 ecx, [0x1d23086]

        $sequence_24 = { 31c9 8b55f4 8b75ec 89723c c7424003000000 }
            // n = 5, score = 100
            //   31c9                 | xor                 ecx, ecx
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   8b75ec               | mov                 esi, dword ptr [ebp - 0x14]
            //   89723c               | mov                 dword ptr [edx + 0x3c], esi
            //   c7424003000000       | mov                 dword ptr [edx + 0x40], 3

        $sequence_25 = { 83ec44 8b4508 8d0d2030d201 31d2 890c24 c744240400000000 }
            // n = 6, score = 100
            //   83ec44               | sub                 esp, 0x44
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d0d2030d201         | lea                 ecx, [0x1d23020]
            //   31d2                 | xor                 edx, edx
            //   890c24               | mov                 dword ptr [esp], ecx
            //   c744240400000000     | mov                 dword ptr [esp + 4], 0

        $sequence_26 = { 890424 894c2404 e8???????? 8d0d3430d201 }
            // n = 4, score = 100
            //   890424               | mov                 dword ptr [esp], eax
            //   894c2404             | mov                 dword ptr [esp + 4], ecx
            //   e8????????           |                     
            //   8d0d3430d201         | lea                 ecx, [0x1d23034]

        $sequence_27 = { 4154 4155 4156 4157 488d68c8 4881ec10010000 448b4568 }
            // n = 7, score = 100
            //   4154                 | dec                 eax
            //   4155                 | mov                 ecx, esi
            //   4156                 | dec                 esp
            //   4157                 | lea                 eax, [ebp + 0x38]
            //   488d68c8             | mov                 ecx, dword ptr [ebp + 0x40]
            //   4881ec10010000       | mov                 eax, ecx
            //   448b4568             | mov                 ebx, dword ptr [ebp + 0x48]

        $sequence_28 = { 415c e8???????? 5f 5e c3 663b559c 0f85217efeff }
            // n = 7, score = 100
            //   415c                 | mov                 ecx, 0x2d665b97
            //   e8????????           |                     
            //   5f                   | mov                 dword ptr [esp + 0x7c], eax
            //   5e                   | mov                 ecx, 0x2d665b89
            //   c3                   | mov                 dword ptr [ebp - 0x80], eax
            //   663b559c             | inc                 esp
            //   0f85217efeff         | mov                 dword ptr [ebp + 0x30], eax

        $sequence_29 = { 4585c9 0f84e2840000 4183e901 0f84b2dbffff 4183f901 448915???????? 0f8400cf0300 }
            // n = 7, score = 100
            //   4585c9               | inc                 ebp
            //   0f84e2840000         | test                ecx, ecx
            //   4183e901             | je                  0x84e8
            //   0f84b2dbffff         | inc                 ecx
            //   4183f901             | sub                 ecx, 1
            //   448915????????       |                     
            //   0f8400cf0300         | je                  0xffffdbb8

    condition:
        7 of them and filesize < 2375680
}
Download all Yara Rules