Executive Summary

Recent threat monitoring has identified active malware events associated with the Nymaim / Avalanche Loader malware family targeting networks in Bangladesh. Telemetry indicates over 27,000 malware-related events detected within Bangladesh, suggesting the presence of infected hosts attempting communication with known botnet infrastructure.

Nymaim is a multi-stage malware loader historically used to distribute banking trojans, ransomware, and credential-stealing malware. It was closely associated with the Avalanche botnet infrastructure, a major cybercrime ecosystem disrupted during the international Operation Avalanche law enforcement action.

Despite the infrastructure disruption, residual infections and sinkhole detections continue to be observed globally, including within Bangladesh networks.

Figure: Sinkhole Detection of Nymaim / Avalanche- Nymaim Botnet Communications from Compromised Hosts in Bangladesh

Figure: Detected Nymaim / Avalanche- Nymaim Malware Communications from Bangladesh IP Addresses

Malware Description

Nymaim (also known as Gozi ISFB Loader) is a loader and downloader malware used to deliver secondary payloads such as:

• Banking trojans
• Credential stealers
• Ransomware
• Remote access malware

The malware typically operates through multi-stage payload delivery, enabling attackers to dynamically update malware capabilities after infection. Capabilities include:

• Payload downloading
• Credential theft
• Ransomware deployment
• Persistence through registry modification
• Command-and-control communication over HTTP/HTTPS
• Obfuscation and anti-analysis techniques

Nymaim campaigns frequently target financial services, government institutions, retail platforms, and healthcare systems.

Observed Activity in Bangladesh

Recent telemetry indicates:

• More than 27,000 malware-related events detected
• Activity across 20 different network providers (ASNs)
• Multiple compromised hosts attempting to communicate with botnet infrastructure
• Botnet command-and-control communications captured via sinkhole monitoring

These detections indicate infected endpoints inside Bangladesh networks attempting to reach known malware command infrastructure, confirming the presence of compromised systems.

Infection Details

Traffic analysis indicates the following characteristics:

Malware Family: avalanche-nymaim

Detection Type: Botnet C2 communication captured by sinkholes

Protocol: HTTP / HTTPS over TCP

Event Classification: Malware botnet communication

Sinkhole telemetry indicates that infected hosts attempted outbound communication with previously active botnet infrastructure, a common indicator of compromised systems vulnerabilities.

Targeted Data

Nymaim malware is designed to collect or access:

• Banking credentials
• Payment card information
• System configuration data

These data types are frequently used for:

• Financial fraud
• Account takeover
• Identity theft
• Follow-on cyber attacks

Infection Methods

Nymaim campaigns commonly spread through:

• Exploit kits (Angler, RIG)
• Malvertising campaigns
• Spam email campaigns with malicious attachments
• Drive-by downloads via compromised websites

Users may become infected simply by visiting a malicious webpage or opening infected email attachments.

Indicators of Compromise (IOCs)

Known Malicious Domains: Fast-flux DNS infrastructure is often used to rotate IP addresses quickly

• g-update[.]net
• secure-update[.]biz
• update-service[.]org
• system-check[.]info
• download-update[.]com

Known C2 / Hosting Infrastructure:

• 184.105.192[.]2
• 216.218.185[.]162
• 185.82.202[.]132
• 91.220.131[.]37
• 46.165.197[.]153
• 37.48.120[.]196
• 185.86.149[.]125

Fig: Malicious IP Addresses Associated with Nymaim / Avalanche-Nymaim Infrastructure [virustotal]

Malware File Names Observed

Nymaim frequently disguises itself as legitimate software:

• update.exe
• flashplayer_update.exe
• svchost.exe
• java_update.exe
• servicehost.exe

Persistence Mechanisms

Typical registry persistence locations include:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random>

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\<random>

Example:

C:\Users\Public\svchost.exe

Behavioral Indicators

Typical infected host activity includes:

• Outbound HTTP/HTTPS connections to random domains
• Encrypted payload downloads
• Communication with multiple fallback C2 servers
• Domain Generation Algorithm (DGA) activity
• Suspicious executables created in:

C:\Users\<user>\AppData\Roaming\

C:\Users\<user>\AppData\Local\Temp\

Network Detection Recommendation

Monitor HTTP traffic patterns such as:

/gate.php

/checkin.php

/load.php

/update.php

For an Example IDS rule concept:

        alert tcp any any -> any 80 (msg:"Possible Nymaim C2"; content:"/gate.php"; sid:100001;)

SIEM Detection Recommendation

SOC teams should monitor for:

• Executables launched from Temp/AppData directories
• Suspicious PowerShell or rundll32 downloads
• Outbound connections to rare domains
• Abnormal DNS query patterns
• Fast-flux domain behavior.

Defensive Recommendations

Organizations are advised to:

• Block known malicious domains and IPs
• Deploy DNS sinkholing
• Monitor newly registered domains
• Use sandbox analysis for suspicious attachments
• Implement endpoint detection and response (EDR)
• Conduct continuous network monitoring

Incident Response

If infection is suspected:

• Immediately isolate affected systems
• Conduct malware scans and forensic investigation
• Reset compromised credentials
• Remove persistence mechanisms
• Restore systems from trusted backups

Organizations detecting suspicious activity should report incidents to cti@cirt.gov.bd or info@cirt.gov.bd 

Download as PDF