Extracted

• • Target
    file.exe
  • Size 352KB
  • SHA256 146286e677cda23a64aa43741ca1aa856e4ff7a1cb242c383a4d4819a86a0ea7
  • MD5 a911e755941c7cfdc95dfd1b368461e3
  • SHA1 b1112d1bcef31cf99ce1c6df1c57625cac6c92f0
  • SHA512 1ce09e5b4f43582a4a24bf3d0be606f18b153e546915d8d728d8b99dcf98035d875b39d30a50ef59d18b33481e25013a69460d3ef6fef737ebd3bc799b25e674
  • SSDEEP 6144:5YfxLedJT1j2i3agA7Ukk6CPu+xMbzKATuzbgwu3bwVfE:5o6dJZj22AYk5CW3bHunnWL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2