Extracted

• • Target
    file.exe
  • Size 233KB
  • SHA256 e8bede1739e54a7f743e894df56ba8d6a355b1495db951e392e1ecf38a20e2e0
  • MD5 703566301eb3df1418c240819c44c6d4
  • SHA1 73131b23377d1ad74ebaa957e2e66eac496ea7fe
  • SHA512 964fcdef879b0fc1cae74160d4199ef75d5c87b9cb9de1bce0e8cdaa644f5b31fb8a6789af866edbd87a01142ad200b846d45d69464911bd959b12519a9a1555
  • SSDEEP 3072:+ThdUOEgysPR+lNgOJ1IBz2v/XrCYFqFeOGRca045s+N84V7LaGinYDvbng6xZUY:+qgypUOJie/hFqIR94+5o/nIrWrY8v+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2