Extracted

• • Target
    file.exe
  • Size 258KB
  • SHA256 f778ab48c15c763851f9ded15e8e1d820cfeab44201e0cecee97a30dcbea95bb
  • MD5 e72aa3bdaeba4b143cd3a4a05665adb7
  • SHA1 13bf4b4bfc9e69f86869b96b69867ade9dca2284
  • SHA512 3035c3bf29b4841f444f68d1e8d727d5f96e8a564233e25ee6f861e969ee991f4889a9b7ce6134a198480aa1305ff3355fdecb12f95d9ef3e55f210b0293c46a
  • SSDEEP 3072:IPLSoWcF4+x35agV7BMLjvrNX0GpZO2fPNUsurmY4tbsRZKER59tcXZUQcgHO+CT:+CfS7BebrPDmsA4tbUR3uWQcgdsc3+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2