Extracted

• • Target
    file.exe
  • Size 222KB
  • SHA256 f106ff110ab03ff758d284e5aa78e7abe06e85a16ea8da70a44f3db38cb1db90
  • MD5 de72e604ad6f6ddc762f95af607a5571
  • SHA1 39a20c231476ced6a699b78aa040b80041406896
  • SHA512 415437ee7f007982cdb68f6be9c3c0a351e05973562da79456163ff35960c9d9488f759f4618f50ce1e2086d642751f91cead74a39aec8b5a470968ff87b1594
  • SSDEEP 3072:CspcEFDXORzELBr2Fa9wADvtkthWhMysAgErk4pais+hDpfvaJ1Mhq70AqdnkMyP:CEHoMyAD2+rsAg2sis+hDlCVGkMyW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2