Extracted

• • Target
    file.exe
  • Size 220KB
  • SHA256 1699ab2468f1f8f8847c9cb5cf3b6c0ce1963c6aea731a817041d32ff68266a4
  • MD5 fa2547ce4b4fd3ffb98fffeb8576472b
  • SHA1 be0a85f273974537a150f458ff42e23ce8d0e3e5
  • SHA512 f226d048774de62619e5c59bb2bf07606ec21e7f999b14ef8743e6026263941c6a7c0a7894c7341046107d5de4faa9d2c7e7f999635e0c1ebf3debd0e1d7bc22
  • SSDEEP 6144:EKlh0QawIBpg4nFMkGwYEU4x6WMKRfNrywk0is2:qQaw+pg4nF33YEQtKRzkp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2