Extracted

• • Target

    file.exe

  • Size

    353KB

  • MD5

    04d833f2a5283abf94ce91e7c3193655

  • SHA1

    2cd80141acbd1675f49aeab06369750df7463f8d

  • SHA256

    2e6ca529baba544cf9177312c70eaddee67b8d456d0101b9275042e3db7feb4f

  • SHA512

    f5f2591c7a770011e450bbcd1ed024dd65cfdd3551ca13b62340a57b6a75bac309166382024f5ffd842b44408da4390ca968913a2b403f7d5a0dd9614da73ff1

  • SSDEEP

    6144:eBC0L1AIo0HEquZiaHQWWHpvuzbgwuoE9NwVf:ephhcLVvWtunnHE9

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2