Extracted

• • Target
    file.exe
  • Size 351KB
  • SHA256 e624b64f0e1bbdf526afe45534f4900222135df0f189496b4a2a3a76dedeaebe
  • MD5 941c4f4309163952cc116d0be6e7c14d
  • SHA1 f16768f45d3f03925c53f3f6bee18e1bbb85cb0d
  • SHA512 ce4fe4ad2b48fc6260a079c7b4c7735bf6a3e003414757f00ea4b0fd51f9d8a72ec40f9c65670baf75ca247a814713f9af4f6151b0a355541b41f99b591a6c62
  • SSDEEP 6144:PCmEjWqmXBAkWR3r8A1bzjoBbn6a3AGuzbgwuFvZwVf:PPEjW1QR34A1LIbnZ9unn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2