Extracted

• • Target
    file.exe
  • Size 220KB
  • SHA256 6b8fcffe18ce0d056ea53b7e3e64d19c78c5cbefd00cdf5cbdcc236695510259
  • MD5 56330a39c82c3b3fb5b04429c3187b2e
  • SHA1 12f014f65d02a4b578b28c575a433ed9fa42c0ca
  • SHA512 6d72b85a99ff81feabd7c61910a276e41fcc0a94372a5e4adb820defd60d64f1e70463f1b7338c122f691e248fbd5cc928747a039b2804717a6165bbdd2ceb20
  • SSDEEP 3072:rzi1iGORd4XGOIWgyg147yLt+NNaiHCWQ2AQFnu3mvKkkqBJnEM86sSBtBoB:oivVLWgyPyh+j1HCWQQvKuv86sSf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2