SYMBOLCOMMON_NAMEaka. SYNONYMS
win.nymaim (Back to overview)

Nymaim

aka: nymain
VTCollection     URLhaus      

Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.

References
2022-09-15SekoiaThreat & Detection Research Team
PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2021-02-08Lawfare BlogDavid Hechler
What Is the Point of These Nation-State Indictments?
Gameover P2P Nymaim
2019-05-20SentinelOneSentinelOne
GozNym Banking Malware: Gang Busted, But Is That The End?
Nymaim
2019-05-16Department of JusticeOffice of Public Affairs
GozNym Cyber-Criminal Network Operating out of Europe Targeting American Entities Dismantled in International Operation
Nymaim
2019-05-16The Shadowserver FoundationThe Shadowserver Foundation
Goznym Indictments – action following on from successful Avalanche Operations
Nymaim
2019-05-16SecurityIntelligenceLimor Kessem
GozNym Closure Comes in the Shape of a Europol and DOJ Arrest Operation
Nymaim
2019-03-12ProofpointGeorgi Mladenov
Nymaim config decoded
Nymaim
2019-01-18Github (coldshell)Coldshell
Nymaim deobfuscation
Nymaim
2017-10-05Virus BulletinCatalin Valeriu Lita, Doina Cosovan
Linking Xpaj and Nymaim
Nymaim
2017-01-30CERT.PLJarosław Jedynak
Nymaim revisited
Nymaim
2016-11-02Ariel Koren's BlogAriel Koren
Nymaim Malware: Deep Technical Dive – Adventures in Evasive Malware
Nymaim
2016-09-27Talos IntelligenceEdmund Brumaghin
Threat Spotlight: GozNym
Nymaim
2016-09-14DeloitteDeloitte
The evolution of the Nymaim Criminal Enterprise Threat Intelligence & Analytics
Nymaim
2016-04-14SecurityIntelligenceLimor Kessem, Lior Keshet
Meet GozNym: The Banking Malware Offspring of Gozi ISFB and Nymaim
ISFB Nymaim GozNym
2016-02-26ProofpointProofpoint Staff
Nymaim Moves Past Its Ransomware Roots - What Is Old Is New Again
Nymaim
2014-11-04BitBucketDaniel Plohmann
IDApatchwork Repository
Nymaim
2014-01-01Fraunhofer FKIEDaniel Plohmann
Patchwork: Stitching against malware families with IDA Pro
Nymaim
Yara Rules
[TLP:WHITE] win_nymaim_auto (20230808 | Detects win.nymaim.)
rule win_nymaim_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.nymaim."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 89d8 01c8 31d2 f7f7 }
            // n = 4, score = 1800
            //   89d8                 | mov                 eax, ebx
            //   01c8                 | add                 eax, ecx
            //   31d2                 | xor                 edx, edx
            //   f7f7                 | div                 edi

        $sequence_1 = { 0f94c1 09c8 6bc064 09c0 }
            // n = 4, score = 1700
            //   0f94c1               | sete                cl
            //   09c8                 | or                  eax, ecx
            //   6bc064               | imul                eax, eax, 0x64
            //   09c0                 | or                  eax, eax

        $sequence_2 = { 31d2 f7f7 92 31d2 }
            // n = 4, score = 1700
            //   31d2                 | xor                 edx, edx
            //   f7f7                 | div                 edi
            //   92                   | xchg                eax, edx
            //   31d2                 | xor                 edx, edx

        $sequence_3 = { 92 31d2 bf64000000 f7f7 }
            // n = 4, score = 1700
            //   92                   | xchg                eax, edx
            //   31d2                 | xor                 edx, edx
            //   bf64000000           | mov                 edi, 0x64
            //   f7f7                 | div                 edi

        $sequence_4 = { c1e105 01c8 c1c307 30c3 }
            // n = 4, score = 1600
            //   c1e105               | shl                 ecx, 5
            //   01c8                 | add                 eax, ecx
            //   c1c307               | rol                 ebx, 7
            //   30c3                 | xor                 bl, al

        $sequence_5 = { 31c9 38f0 83d100 38d0 83d900 c1e105 }
            // n = 6, score = 1600
            //   31c9                 | xor                 ecx, ecx
            //   38f0                 | cmp                 al, dh
            //   83d100               | adc                 ecx, 0
            //   38d0                 | cmp                 al, dl
            //   83d900               | sbb                 ecx, 0
            //   c1e105               | shl                 ecx, 5

        $sequence_6 = { c1eb13 331d???????? 31c3 c1e808 }
            // n = 4, score = 1600
            //   c1eb13               | shr                 ebx, 0x13
            //   331d????????         |                     
            //   31c3                 | xor                 ebx, eax
            //   c1e808               | shr                 eax, 8

        $sequence_7 = { 00d3 8a16 301e 46 01fb }
            // n = 5, score = 1300
            //   00d3                 | add                 bl, dl
            //   8a16                 | mov                 dl, byte ptr [esi]
            //   301e                 | xor                 byte ptr [esi], bl
            //   46                   | inc                 esi
            //   01fb                 | add                 ebx, edi

        $sequence_8 = { 8b12 8b4d0c 8b5d18 8b1b 4f 31c0 fec2 }
            // n = 7, score = 1100
            //   8b12                 | mov                 edx, dword ptr [edx]
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b5d18               | mov                 ebx, dword ptr [ebp + 0x18]
            //   8b1b                 | mov                 ebx, dword ptr [ebx]
            //   4f                   | dec                 edi
            //   31c0                 | xor                 eax, eax
            //   fec2                 | inc                 dl

        $sequence_9 = { 8b4e08 014e04 8b5e0c 015e08 }
            // n = 4, score = 1100
            //   8b4e08               | mov                 ecx, dword ptr [esi + 8]
            //   014e04               | add                 dword ptr [esi + 4], ecx
            //   8b5e0c               | mov                 ebx, dword ptr [esi + 0xc]
            //   015e08               | add                 dword ptr [esi + 8], ebx

        $sequence_10 = { c1e808 31c3 895e0c 89d8 }
            // n = 4, score = 1100
            //   c1e808               | shr                 eax, 8
            //   31c3                 | xor                 ebx, eax
            //   895e0c               | mov                 dword ptr [esi + 0xc], ebx
            //   89d8                 | mov                 eax, ebx

        $sequence_11 = { f7e0 0fc8 01d0 894704 }
            // n = 4, score = 1100
            //   f7e0                 | mul                 eax
            //   0fc8                 | bswap               eax
            //   01d0                 | add                 eax, edx
            //   894704               | mov                 dword ptr [edi + 4], eax

        $sequence_12 = { 8b06 c1e00b 3306 8b5604 0116 8b4e08 014e04 }
            // n = 7, score = 1100
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   c1e00b               | shl                 eax, 0xb
            //   3306                 | xor                 eax, dword ptr [esi]
            //   8b5604               | mov                 edx, dword ptr [esi + 4]
            //   0116                 | add                 dword ptr [esi], edx
            //   8b4e08               | mov                 ecx, dword ptr [esi + 8]
            //   014e04               | add                 dword ptr [esi + 4], ecx

        $sequence_13 = { 53 56 57 83ec44 8b4508 8d0d2030d201 }
            // n = 6, score = 100
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   83ec44               | sub                 esp, 0x44
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d0d2030d201         | lea                 ecx, [0x1d23020]

        $sequence_14 = { 4409df 4531d0 813d????????7147ed3a 0f84c06efdff 4421da 4431c7 c1c703 }
            // n = 7, score = 100
            //   4409df               | inc                 esp
            //   4531d0               | or                  edi, ebx
            //   813d????????7147ed3a     |     
            //   0f84c06efdff         | inc                 ebp
            //   4421da               | xor                 eax, edx
            //   4431c7               | je                  0xfffd6ec6
            //   c1c703               | inc                 esp

        $sequence_15 = { 0f84e0bffcff 443b642460 72b4 85ff 7439 837c246000 7628 }
            // n = 7, score = 100
            //   0f84e0bffcff         | je                  0xfffcbf63
            //   443b642460           | inc                 esp
            //   72b4                 | cmp                 dword ptr [ecx + 0x94], esp
            //   85ff                 | jne                 0xfffcbf4b
            //   7439                 | mov                 esi, dword ptr [ecx + 8]
            //   837c246000           | inc                 ebp
            //   7628                 | lea                 ebp, [esp + 1]

        $sequence_16 = { 4531c9 488d442440 813d????????00e8e23a 0f84c1f7feff 31d2 48b9????????00000000 488903 }
            // n = 7, score = 100
            //   4531c9               | je                  0xbea1
            //   488d442440           | inc                 esp
            //   813d????????00e8e23a     |     
            //   0f84c1f7feff         | sub                 dword ptr [ebx + 0x68], ebx
            //   31d2                 | mov                 eax, dword ptr [ebp + 0x48]
            //   48b9????????00000000     |     
            //   488903               | mov                 dword ptr [esp + 0x48], eax

        $sequence_17 = { 448915???????? 8b4548 89442448 488b8588000000 4889442440 488b8580000000 4889442438 }
            // n = 7, score = 100
            //   448915????????       |                     
            //   8b4548               | dec                 esp
            //   89442448             | mov                 edx, edi
            //   488b8588000000       | dec                 eax
            //   4889442440           | lea                 edx, [esp + 0x40]
            //   488b8580000000       | dec                 eax
            //   4889442438           | lea                 ecx, [ebp + 0xa0]

        $sequence_18 = { 56 83ec28 8b450c 8b4d08 8d154e30d201 }
            // n = 5, score = 100
            //   56                   | push                esi
            //   83ec28               | sub                 esp, 0x28
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8d154e30d201         | lea                 edx, [0x1d2304e]

        $sequence_19 = { 55 89e5 83ec10 8b4508 8d0d3430d201 }
            // n = 5, score = 100
            //   55                   | push                ebp
            //   89e5                 | mov                 ebp, esp
            //   83ec10               | sub                 esp, 0x10
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d0d3430d201         | lea                 ecx, [0x1d23034]

        $sequence_20 = { 83ec44 8b4508 8d0d2030d201 31d2 890c24 c744240400000000 }
            // n = 6, score = 100
            //   83ec44               | sub                 esp, 0x44
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d0d2030d201         | lea                 ecx, [0x1d23020]
            //   31d2                 | xor                 edx, edx
            //   890c24               | mov                 dword ptr [esp], ecx
            //   c744240400000000     | mov                 dword ptr [esp + 4], 0

        $sequence_21 = { 0f9e05???????? 4c89fa e8???????? 488d542440 488d8da0000000 890d???????? 8805???????? }
            // n = 7, score = 100
            //   0f9e05????????       |                     
            //   4c89fa               | je                  0xfffcbfe6
            //   e8????????           |                     
            //   488d542440           | inc                 esp
            //   488d8da0000000       | cmp                 esp, dword ptr [esp + 0x60]
            //   890d????????         |                     
            //   8805????????         |                     

        $sequence_22 = { 4439a19c000000 0f8456bffcff 4439a194000000 48c705????????b2228979 0f8545bffcff 8b7108 458d6c2401 }
            // n = 7, score = 100
            //   4439a19c000000       | and                 edx, ebx
            //   0f8456bffcff         | inc                 esp
            //   4439a194000000       | xor                 edi, eax
            //   48c705????????b2228979     |     
            //   0f8545bffcff         | rol                 edi, 3
            //   8b7108               | inc                 esp
            //   458d6c2401           | cmp                 dword ptr [ecx + 0x9c], esp

        $sequence_23 = { 31ed e8???????? 0fb7542430 488d4c2420 0fb7442432 4189d8 c1e209 }
            // n = 7, score = 100
            //   31ed                 | inc                 ebp
            //   e8????????           |                     
            //   0fb7542430           | sub                 eax, ebx
            //   488d4c2420           | inc                 esp
            //   0fb7442432           | mov                 edx, ebx
            //   4189d8               | dec                 eax
            //   c1e209               | add                 edx, ecx

        $sequence_24 = { 5b 5d c3 8b45f0 8b0c850440d201 }
            // n = 5, score = 100
            //   5b                   | pop                 ebx
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   8b0c850440d201       | mov                 ecx, dword ptr [eax*4 + 0x1d24004]

        $sequence_25 = { 890424 894c2404 e8???????? 8d0d3430d201 }
            // n = 4, score = 100
            //   890424               | mov                 dword ptr [esp], eax
            //   894c2404             | mov                 dword ptr [esp + 4], ecx
            //   e8????????           |                     
            //   8d0d3430d201         | lea                 ecx, [0x1d23034]

        $sequence_26 = { 31c9 8b55f4 8b75ec 89723c c7424003000000 }
            // n = 5, score = 100
            //   31c9                 | xor                 ecx, ecx
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   8b75ec               | mov                 esi, dword ptr [ebp - 0x14]
            //   89723c               | mov                 dword ptr [edx + 0x3c], esi
            //   c7424003000000       | mov                 dword ptr [edx + 0x40], 3

        $sequence_27 = { 4529d8 4489da 4801ca e8???????? 66813d????????a8c1 0f848bbe0000 44295b68 }
            // n = 7, score = 100
            //   4529d8               | jb                  0xffffffc1
            //   4489da               | test                edi, edi
            //   4801ca               | je                  0x4a
            //   e8????????           |                     
            //   66813d????????a8c1     |     
            //   0f848bbe0000         | cmp                 dword ptr [esp + 0x60], 0
            //   44295b68             | jbe                 0x2f

        $sequence_28 = { 31d2 890c24 c744240400000000 8945f4 8955f0 e8???????? 8d0d8630d201 }
            // n = 7, score = 100
            //   31d2                 | xor                 edx, edx
            //   890c24               | mov                 dword ptr [esp], ecx
            //   c744240400000000     | mov                 dword ptr [esp + 4], 0
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   8955f0               | mov                 dword ptr [ebp - 0x10], edx
            //   e8????????           |                     
            //   8d0d8630d201         | lea                 ecx, [0x1d23086]

    condition:
        7 of them and filesize < 2375680
}
Download all Yara Rules