Extracted

• • Target

    file.exe

  • Size

    352KB

  • MD5

    9ca85f1b387e41c15cb5229f37dc352c

  • SHA1

    2e51f51061ca75385b337afc21910f501bc4a073

  • SHA256

    a422a78af01ec7de0be82887cc49d23fc5cd8f452da386f0262b60095da73673

  • SHA512

    5cc3a479c24439a8274568501ea2fff936dafbdf9cf266022a7e2a76d8c589d3ab557ce29d89210a6c1b76b8d545da807d76beaefa270a0ba32003cc6bad1164

  • SSDEEP

    6144:on7TLzKExQq8ux2SI1sRTF/6LGMqpsB2NGuzbgwuJ1JwVf:onvKE7Rx2daNoQgunn

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2