Extracted

• • Target

    736f9602b14da32716ae030c59df040465df95ed48c964b33486c04b0ef1002d

  • Size

    380KB

  • MD5

    c0b4de4f711b7c28369d7a4018f94759

  • SHA1

    4cf0c26459c732e1b334b8a2b4748161d922e657

  • SHA256

    736f9602b14da32716ae030c59df040465df95ed48c964b33486c04b0ef1002d

  • SHA512

    6e0f13d4492841eecf84bba5953aeec94563aa3c5bc11845e6d6a94915cb4493564f920e849a51551328c25aae71674646768a7ec666dd8263767a9ec3293ada

  • SSDEEP

    6144:x/QiQXCykm+ksmpk3U9j0IidOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7LT:pQi3yP6m6UR0IqlL//plmW9bTXeVhDrE

  Score

  10^/10

  nymaimevasionpersistencetrojanvmprotect

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks for common network interception software

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1