Loading story…
Researchers published proof-of-concept tooling to deobfuscate Nymaim malware, showing how analysts can recover cleaner code and improve reverse engineering in IDA Pro. One GitHub project, Nymaim deobfuscation, uses miasm for emulation and grap for graph-pattern matching to identify and patch common Nymaim obfuscation routines such as push_reg, detour_call, and detour_jmp, then generates an IDA script to rename functions and produce a cleaned sample.
A related Bitbucket project, Patchwork, was built to demonstrate malware deobfuscation against the same malware family inside IDA using a modified PyEmu engine. The author described upgrades including stronger memory management, better support for uncommon x86 instructions, and a Python 2.7-compatible rebuild of pydasm, alongside setup guidance for loading Nymaim samples and running the deobfuscation workflow, underscoring a broader effort to automate analysis of heavily obfuscated Nymaim binaries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A public GitHub repository directory for Nymaim deobfuscation was made available in the Malware-Scripts project maintained by coldshell. The proof-of-concept used miasm for emulation and grap for graph-pattern matching to patch Nymaim obfuscation patterns and generate an IDA renaming script plus a cleaned sample.
Daniel Plohmann published the unfinished Patchwork tool to demonstrate malware deobfuscation in IDA Pro against Nymaim samples. The repository included a refurbished PyEmu with improved memory management, rare x86 instruction handling, and a Python 2.7-compatible pydasm build for newer IDA versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint researchers detailed how the **Nymaim** malware family uses an unusual encrypted configuration format built as compiled bytecode and executed by a custom virtual machine embedded in the malware. The analysis shows Nymaim has evolved from a ransomware-style screen locker and downloader into a more capable downloader with **information-stealing** and **system-profiling** functions, giving operators a flexible way to change behavior without rebuilding the core malware. The decoded configuration revealed operational logic including integrity checks, timestamps, versioning, expiration dates, conditional branches, procedure calls, and API-like functions tied to the malware’s main components. Researchers also identified anti-debugging and anti-analysis checks for antivirus processes, sandbox-related libraries, virtual-machine MAC addresses, and suspicious usernames or hostnames, along with payload drop paths, process exclusion lists, DNS settings, and command-and-control domains and URLs that can help defenders detect and track Nymaim activity.
Aug 14, 2026
A reverse-engineering walkthrough showed how **Ghidra** can be scripted to automatically recover obfuscated strings from **Amadey 1.09**, replacing repetitive manual analysis with automated annotation inside the disassembler and decompiler. The script targets the malware's `__Z8aDecryptPc` routine, reproduces its repeating-key subtraction logic in Java, identifies references to the function through Ghidra's decompiler and P-code APIs, and then writes recovered plaintext back into the project as comments and bookmarks. The published results indicate the workflow decrypted **47 strings**, reused **11** cached values, added **210 comments**, and created **47 bookmarks** in about **16 seconds**, illustrating how scripting can accelerate malware triage. The approach aligns with earlier Amadey string-decryption tooling built for **IDA Pro/Hex-Rays**, including a Python script that extracts encrypted operands, derives a key, decrypts strings, and annotates disassembly, showing that analysts are increasingly codifying Amadey deobfuscation across multiple reverse-engineering platforms.
Aug 15, 2026
Reverse-engineering researchers published tooling and documentation that expose the inner workings of **FinSpy**, including a static unpacker, VM disassembler, and deobfuscation components hosted in the `RolfRolles/FinSpyVM` repository. The work targets FinSpy's custom virtual machine protection and provides practical artifacts for analysts to reconstruct protected code, while separate public documentation from the Chaos Computer Club details analysis of FinSpy for Android and includes leaked files, samples, graphs, tables, and a report on the spyware's components. A technical walkthrough describing the devirtualization process said the analyzed FinSpy sample relied on a comparatively weak virtualization scheme in which much of the VM bytecode already contained raw `x86` machine code. The author outlined a four-stage method for simplifying bytecode, recovering virtualized function calls and pointers, and performing a second devirtualization pass to produce a complete `x86` code blob for loading into IDA, giving defenders and malware analysts a clearer path to inspect FinSpy behavior and internals.
Aug 15, 2026