Nymaim

References:

Nymaim – obfuscation chronicles - 2013-08-26 - Eset - Jean-Ian Boutin Nymaim

Meet GozNym: The Banking Malware Offspring of Gozi ISFB and Nymaim - 2016-04-14 - IBM Security - Limor Kessem - Lior Keshet Nymaim Gozi ISFB

Nymaim - The untold story - 2016-10-06 - Lokalhost - Jarosław Jedynak - Maciej Kotowicz Nymaim

Nymaim config decoded - 2019-03-12 - Proofpoint - Georgi Mladenov Nymaim

GozNym Cyber-Criminal Network Operating out of Europe Targeting American Entities Dismantled in International Operation - 2019-05-16 - Department of Justice - DoJ Nymaim

More Reading:

A Peek Into the Lion's Den – The Magnitude [aka PopAds] Exploit Kit - 2014-08-05 - SpiderLabs Magnitude Nymaim Necurs

Nymaim Moves Past Its Ransomware Roots - What Is Old Is New Again - 2016-02-26 - Proofpoint - Proofpoint Staff Sagrid Nymaim

Phish Scales: Malicious Actor Combines Personalized Email, Variety of Malware To Target Execs - 2016-04-05 - Proofpoint - Matthew Mesa TA530 Gozi ISFB TinyLoader Nymaim Dridex Smokebot RecoLoad

Ostap malware analysis (Backswap dropper) - 2018-06-01 - CertPL - Paweł Srokosz Ostap Nymaim

Threat Actor Profile: TA544 targets geographies from Italy to Japan with a range of malware - 2019-07-11 - Proofpoint - Proofpoint Staff TA544 Nymaim Gozi ISFB URLZone