Extracted

• • Target

    file.exe

  • Size

    359KB

  • MD5

    b850cae79bd87b5fa5f3762fea7ac52b

  • SHA1

    4718c0c9f033471e21ea04e43cd0759761e21224

  • SHA256

    8319d37661855ed727fe99fb78a988300b4938e60f4003239ddadf910f4d0da3

  • SHA512

    ab27670ae2ac1c7bb72fef1ad4d776b41714c10661478839d878d19f8ad35556769c30d1d82f92f7bcc4e52a6fc8c912acf5ea0f12a3486efe71573194311de4

  • SSDEEP

    6144:lRTH+eLVVvJyJ5ysGNQm1sQw+z+xaYW3z5LYuzbgwuQR2QrZwVfUPk:vTXB/yJ5U1sl+2aYa5cunn2QTc

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2