Extracted

• • Target

    file.exe

  • Size

    2.7MB

  • MD5

    3fcda4982e1b1b3d0271d6a9743b1a9c

  • SHA1

    def8cf40fc902c3c00b6146727c280998fc876a5

  • SHA256

    a27a4b0e3c3fa8c486ab06011e7b89f3329c8f7acf5989822ca653172c054b7b

  • SHA512

    49f90594cd96d130179f391c01a713ab749052568c5351ae8f26831dff260f42c0532ccd485bb980bf3e78cc8408a30f8be5df5ff6abc0cb1037d22398163320

  • SSDEEP

    49152:Z2WD3xKFPg42pjhp4kALl8HBQi7LEU0DT81FoEgsu1hyrpD8FYPqV7YKtPbA5hq:Mm3T4oAZAQrUqhU8FYP0YrDq

  Score

  10^/10

  nymaimdiscoverytrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2