Extracted

• • Target
    file.exe
  • Size 360KB
  • SHA256 a8dbc8187e7aa8782139a561670f0168f1955869749c8ca665c66e79c47ff3d5
  • MD5 2d005ca67ec7c68c914502f0a095997a
  • SHA1 7a56b6056c9303ebc070358c8cbe8d2979ac551a
  • SHA512 79509e07bcd7e2c963f90b58c5a60c32f7c636f23fb1ff65438459b104cd40798c34fd27fcc8acfa0157a51e4db345021ff0d006fa9274df6f240f1cceb1a1f8
  • SSDEEP 6144:H4hqTLUbn7TBqLF6pcrNObRoW0aEXKxxHRDVZsN5tuzbgwueuwVf:H4hYAb7dqLF6uhAQX6fZKtunn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2