Extracted

• • Target

    file

  • Size

    284KB

  • MD5

    0970dafdfafa8ae3ef40595196b474b4

  • SHA1

    db8c7cea3f3b636afed914010f8d83ef8b83c9a4

  • SHA256

    3b0e3131ca4238809dde2ec2f95d402f679d5fddda8bd85a78204731cb67682f

  • SHA512

    54ec8d50239e91461118f1b773f723351944665ecb6e94a2a77c1c27b2317267e1feef7f7b89538607e202a436736e5d603d793341656eb8b5f784069dc1f2cf

  • SSDEEP

    3072:4dPzML6sXqWa85YS52DjKzMhU8AH8qRfod/e1zYZ+7AllRQecfoTwzyab9DB53ve:qML3qWKWekH7uosZ+7+lRSfDpB3

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2