Extracted

• • Target
    file.exe
  • Size 228KB
  • SHA256 e83bbdd18ec36e49a9b6f3f9a0543c98c3bb1d8dd7f28d42b8bf3f585a76f51a
  • MD5 15eed17841bd5b6153a054e28e3ac708
  • SHA1 19e16e6a68e5840b814b9c3dc9a274223ab1c670
  • SHA512 29994bd84a45db59537e4466c10785bd95494d19c792cf627bc68a4463e8b2b6b952840752ed3f6e0dbe71567335d999fc250d88d882e07544978d08b55ec4c2
  • SSDEEP 3072:MHSUWmmdGRkTzUXTKzb3BD9bpFnYSjN91xogm/seSUrhi/f:+mHb3BBlRRjHrogf0c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2