Extracted

• • Target
    file.exe
  • Size 221KB
  • SHA256 02909fa30eecc37ae2d0b5de4ca9c648857c81ad034da9dca7ae6c53ec4141ea
  • MD5 047f1ae53a2152af09ce3a5adf42ad70
  • SHA1 4abb07fd3dc115a6291cb129a2e8b69c8441de24
  • SHA512 80bdae492fcf46a1efdb06af63fe11d27717f088fcc60b8596c5adf9babc01d112aaeba6f8e27a307705bbe045ee63ad2b37cdbe84c4510140198e00e1775bf4
  • SSDEEP 3072:s0cwFEORYYbdWAKOBkc8Y1nwPiSpDfQg0RMBpXuKxkFmjpqmyxjb6SpP7NinBxRs:VF0BOBVL1wrfYmuZFmjpWZRpJYRRI8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2