Extracted

• • Target

    c45e03cbd3d15558d68880a956d0356019a55fe4ff67fe07e1083b4ab2f42a97.exe

  • Size

    2.4MB

  • MD5

    1521c5ae3f706092ddd6a0d3f68d92af

  • SHA1

    b22542c4c88c5c796ca7a3f017b13bd56e7f345c

  • SHA256

    c45e03cbd3d15558d68880a956d0356019a55fe4ff67fe07e1083b4ab2f42a97

  • SHA512

    13e53be7cf12ff2e32ad5afce4dc204e2bc1d0f8d9b0d521e56c064410d7bfafe3b19875909b452a6d17bb6058911351c1478652c59728431cafc6b4a9ee7cab

  • SSDEEP

    49152:0Nur/V4cUZqpBdRiGItNfOM4r0o0AO0HyErH6eOCgSY/Z:0Ny/fsqp1S3Op0AbHyJcY/Z

  Score

  10^/10

  nymaimdiscoverytrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2