Extracted

• • Target
    file.exe
  • Size 360KB
  • SHA256 2382cd4d33346b25dbb6fe22aa56ec17744518e8bdcd02238ff91aa835c1274c
  • MD5 6fa2e2fbc27d6146213129d39a616c82
  • SHA1 f557da2f668aa12e67bad7fd83c24f1fe84bc91c
  • SHA512 975818b00b912d1c975a8ab96b0171cf2f238689e35e8d04963c5b79ae2b35e2cb25dfc73dd49c9c52f8d1ca8a80ae2a80c94fabf42ac9578d95dc28af88e30d
  • SSDEEP 6144:5QfqWOY9aLgPckV1jNWqqw8Nr3G/WxzvBISa+BuzbgwuPawVf:54qWmcPckJWqqws34Cb04unn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2