Extracted

• • Target

    file.exe

  • Size

    1.9MB

  • MD5

    426bc2bb6d548cb7af0ac880f8e0a399

  • SHA1

    6b8bc43f3981b814c90b1dd66b363c2d7c065c39

  • SHA256

    d82a0347876fdc2504368327445f74608145862f9c6f9d60ee73db698e99ac45

  • SHA512

    adfcb916f1cb4397713f2e3a4e679f9c49cb76802dac6339ea2d2c8398d9d22303a8b406506e2f2750515082e95e7ce3b0ff8c7f8b68889052672b60c5271fe2

  • SSDEEP

    49152:KinmpIH2kaLNz+K6wQC8A2fV4VA7KgwWPBTe/mjLX/nvYX0mu:KinnH0R6K6wQCSF7fw0BC/mjLvvYO

  Score

  10^/10

  nymaimdiscoverytrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2