Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    a911e59bb5ca00c8b7f0384c3b150b57

  • SHA1

    c95ba64c5dd19b9ece75c6f60036311630c91595

  • SHA256

    c26ad46af2e7ad3af9af6837d7e50274a152ed945ea389bea0f6a32ddab23813

  • SHA512

    9191c79ffc09b984479012af95309956e2aa37cc95c047da1ba1c71c0e1e2d5e534846a094fd86d9a939e7bcf4c76f339fefa727ee8ed47c24516c9fbfdafc40

  • SSDEEP

    49152:KiJDgAQCunXa2tNqRj764HVzOW2rgsD98TkAasPgpCZao:KiJ0AQCoyZ64HV6FBD98TLPgpCMo

  Score

  10^/10

  nymaimdiscoverytrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2