Extracted

• • Target
    file.exe
  • Size 351KB
  • SHA256 2092cc4d968bf2270788439720ee904ea0b1acfb39a0b6aefd48db7fd2fb5aea
  • MD5 24432e55bde313c6d39a7f961b493c1f
  • SHA1 d50aae903dfadcf0351c838806a72cda604b7ca5
  • SHA512 c739cc8acd1627f457a215d54e368f726bfd8d91ed1339c7aba170339ecacaec13d96cdeaf765518caf34c28d227733d065b221e4ccfc7c48059fdc8807def2f
  • SSDEEP 6144:QPyLyp2Hs850nQ20VcmUJUaSu4QjcOFOr8XjkuzbgwucjOdnwVfE:Q6mp2HsEixSu4QL0unnrS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2