GOZNYM MALWARE | Dragon News

GozNym is a hybrid Nymaim/Gozi malware campaign observed in March–April 2016 that combines a Nymaim-style loader with Gozi banking trojan functionality; the report lists sample MD5s, domains, C2 IPs, DNS/WHOIS data, and network behaviours (HTTP POST C2, DNS responses that do not match POST destinations), and notes targeting concentrated in the US, Austria and Germany with time-limited samples and active C2 infrastructure.