Extracted

• • Target
    file.exe
  • Size 359KB
  • SHA256 0de56e567b2d39e8a6a22cfdabadf9396975ce34acfbbb90e55052dd30dc18b9
  • MD5 bda263ea4f1681added182faaf815513
  • SHA1 d610b8399e7107ea17a9bca2ce2b4191a65b66f4
  • SHA512 10563bdf8c2126f720f3c0843c58d03d780f8d123b6654f678fbf31f5cace183e65de2c4220ca27edd78f52fd1119c3e37758e00089b71192746cec1e1b40960
  • SSDEEP 6144:sPu8KxLfsGgsRxtkRQStRTO9WOnqwuzbgwuE0wwVf:sPtKxAGgsL2QSXqntunn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  nymaimtrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2