Extracted

• • Target

    extrim.exe

  • Size

    25KB

  • MD5

    e57942bcdcbea1e24f8eb91f28d941ed

  • SHA1

    03a80129434d5721a1883f8cde5b89b94ded4026

  • SHA256

    ec4cd327cf62d00bd67b54eb786c6e81af270fdc17d31d6861670aefdaa92ea1

  • SHA512

    e6fa2f08b9d339b5de2483373891dad44e6b7ff832190770acabd005c1987acac2c22891b272a73861e86b2e7b65ca681e42774141023809beac46a6b6f7c422

  • SSDEEP

    768:5vkgXF2UVmVknCwRRi7iEIk9Pm5huNR2R:ygQUVm4CwRRqD9PwuNR2R

  Score

  10^/10

  njrat??????? ??????? ??????? ?? ????persistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2