Extracted

• • Target
    file.exe
  • Size 220KB
  • SHA256 5dfd8473666a265169799a706fd0dc4d82b51ef5769aa8162b5f485f47e6dadc
  • MD5 177ee51f8fb3e5823a4ea2565ec704ef
  • SHA1 67a3684a1a6a6986602dca356191212ab6a6ecaa
  • SHA512 331d132a943febe9f18850dc421a38077ace99c27be2986eff610e7b10a3a98b9b639f3fad4ae17a2cf144602517551609269890301642715f50328733b7507e
  • SSDEEP 3072:r6K8KOR1cjUs+yUGmSbfyq6ewncdztA6Syhb4y8z4GKzPSp7MxNVPgd:KzcQzHuYeAcdS6SyhMrmPMwxNpgd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2