Extracted

• • Target

    file.exe

  • Size

    352KB

  • MD5

    226be453da7e4da36b7f6bf020373a1b

  • SHA1

    a9ca27cc1862ad2f98aa19108614c4d287d0b5e3

  • SHA256

    43a8f021fdbb8f677fd11534eb8ef79f1f32a11c62ec6dd97304c2e17bb2a2c0

  • SHA512

    1a2b8b74e59ea787029afbf0bfefe6709ff5af031d28902d70903869bf4cf73a3e10cf3e549d9789435349328485dee3041490e86cf122ab30360400989bffaf

  • SSDEEP

    6144:uFV7xF87gDNsqbClExfFq7dg8K/EymhheuzbgwufbvwVf:utzsqGCNA7q8qmiunnmb

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2