Extracted

• • Target
    file.exe
  • Size 359KB
  • SHA256 fbc6bc45a7fed79f3d44c4d2f3d0e2c469ae4ef24243bc0f5a3ae7eb6f395824
  • MD5 586ba7b420923c1ea0d16600753993b1
  • SHA1 b4e13d100b5cd04c0c7f2e39c92fae9a1bdd65ba
  • SHA512 041496a91d8365eb32c00903b4e8439751153e293134a4b753b8839ed7ca730d3bc2e537b3cc5fc726e23730b0b6789bd8758e49a378e871ce7bbcb311debb9a
  • SSDEEP 6144:S/S+o4MBvzU7cD97Vtu88BRyC+lKHpeFwfiga3wVfg:S5MBY7cDc1BsQ43p
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2