Extracted

• • Target
    file.exe
  • Size 233KB
  • SHA256 cf1d954d28450dfbecce6d8d93d73a8526407261df872867ecc373da1129105b
  • MD5 8589d0babc5495274097a0b40ad5e8a9
  • SHA1 d9f4c9f032b73d8203cd0012b5422b9672875ef6
  • SHA512 a487a671b4a0c3ca478da415be45c4d1c20126030f45146917faebc9a253c6ca9e937bb32fdd51badbf009c121eb6988fdcce78a884f37c5879d769b973a965e
  • SSDEEP 3072:yKijhaRZCSHDKPx3O9ROHJjnFyeiJclo7iMO+k7n7+G4RrFxWcUWtdsWBRtFfJUj:yKLHDKPhOqpjFyeiJVVk773hWFftFF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2