Extracted

• • Target
    file.exe
  • Size 220KB
  • SHA256 2b9da040e7c0dde1309b8d3d6a1e27eebd8c9f5a101ef40c9650c29916964cfd
  • MD5 f8ab61f4e5dc8bb680b0243093af6680
  • SHA1 117e05ab08fe1f6e5436dd4f4aac8237e9f39339
  • SHA512 87f8fb9d75d3ead84d8e3f282005e5e0d11b73a73b99193e8b487b29c7881c340a37dd6a310dbe096da4fe27f15bc57ab5110e8387413b876c3b7e2eccab9597
  • SSDEEP 3072:doNXTu1OR22P4nlatvdB1UvANfixRUDEFc6anu6FleboLb/EGusjL:ioz/wFBSvAuR8aanvGb2YGus
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2