Backdoor.Bladabindi
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 6,610 |
| Threat Level: | 60 % (Medium) |
| Infected Computers: | 105,802 |
| First Seen: | May 1, 2013 |
| Last Seen: | April 13, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Aliases
15 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| Ikarus | not-a-virus:RiskTool.Win32.BitCoinMiner |
| Sophos | Bitcoin Miner |
| Kaspersky | not-a-virus:RiskTool.Win32.BitCoinMiner.cns |
| AVG | Generic32.CKXR |
| Sophos | Troj/Agent-ABNT |
| Kaspersky | Trojan.Win32.Redyms.pix |
| Avast | Win32:Rootkit-gen [Rtk] |
| Panda | Trj/Genetic.gen |
| AVG | Crypt_s.AVA |
| Ikarus | Trojan.Crypt_s |
| AhnLab-V3 | Dropper/Win32.Clons |
| AntiVir | TR/Crypt.TPM.Gen |
| Comodo | Backdoor.Win32.Agent.SPA |
| Kaspersky | Trojan-Dropper.Win32.Clons.zzx |
| F-Prot | W32/Boaxxe.F2.gen!Eldorado |
SpyHunter Detects & Remove Backdoor.Bladabindi
File System Details
Backdoor.Bladabindi may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | c5dbc4b5114eccb1261dfdb2194089a8.exe | 52e8d405637fbd963055823c15f0f9a1 | 144 |
| 2. | 48d63ee9bfd6d65c02373667cd2c8697.exe | 71fb65eb058f3eec32c74a04a78e831c | 61 |
| 3. | 5f805e177fa7c673482c92c255460b67.exe | d313b3409a30ce1040ce3d010f4e4b99 | 39 |
| 4. | 017896e94ee32e077c688af9a248e03f.exe | dc45685c7921768488485c054a5562b0 | 25 |
| 5. | 56950d8c4bc04b6faabb3fd849300f81.exe | e0d78fe03901a9a7d6b2bdae3c14cb72 | 19 |
| 6. | 7a4c1aa1519c6bee178f8fbf3ccffa01.exe | fecb975fe7b949c414640a3ff2cbae88 | 15 |
| 7. | e7519346edbd1261bb7e4084fb50cd6b.exe | e4396258e2a50828a318f2d35785d93d | 14 |
| 8. | 58c6ed6a71daea3cb58e4fa06beab2bd.exe | 3a101e54c316fbf58778c71dda9299e5 | 12 |
| 9. | 3008b25cd890618ead84115e2b073a47.exe | fd21ff54f5a33b5b37260814d0731c2a | 11 |
| 10. | troj_generic_ebc5a6b5083f5b9a0d2e2aadfd2daa3d3697a23461c0cc40ff347672c75767d0.exe | d682acc4b6eae500dc3c908dbaedf519 | 10 |
| 11. | a0bd4888d482d751fa2518c73e7d2a9f.exe | 5a33c50a8117f87ae4ef0da3bacfb12d | 10 |
| 12. | 62b4a7f32364bd20762dd3b30db01d93.exe | 09d66712ca96bd1a7d627e66c60b2b9c | 9 |
| 13. | cc6885fb771802b45c9dcc628f9ad989.exe | de479c9e92ecc1ac8447901cdce64bce | 8 |
| 14. | 5db5c656e6f615eba326e0e421c56c58.exe | 270c797a677b22b3f768350412969936 | 7 |
| 15. | 79c3667e6e3ee30e7cbb11fd90ef9fe4.exe | fa3c14ca50dbc11e58800f1bdf462f5f | 7 |
| 16. | 3565237e66224ab2498e196ce0aff5cd.exe | 522848c65ceb2f2acb9fcfb2e99a94e6 | 7 |
| 17. | 69b5b7ca364f50a6f2ca0f32b9e3c064.exe | 4c721d10ff63f1ec9bb0415a4a7a5c0e | 7 |
| 18. | a5ab2dbc68c601545cd9a9946ac0b01c.exe | 3715f2a674f9b3996b0309724188aa73 | 6 |
| 19. | 9f192a1f8ea7e654ab7f4f6227bc120c.exe | 3770847fb83d43a0fa2c2a9cff45202f | 5 |
| 20. | f683abc40afcb2fb0f4a33d15709c9b7.exe | 09604a0cc24b679da7cf9b2c0d576410 | 5 |
| 21. | 7d4366b7a274f87b26c436a0e40a9090.exe | d62a817ace66b957d2602656b78d142f | 4 |
| 22. | db87ad7e45211040c408f1ad355e0739.exe | 9c809e09d971aab8c42f77f4fb5effd4 | 3 |
| 23. | adf954c8b8af53ba18232ab9e7f642d4.exe | c797a3bf5ed730a47d8324aed964bcc4 | 3 |
| 24. | 163ea917cb09d012dda3841f98d3c236.exe | 78c6b9e3ad95a1715d7c2a129c0b65e2 | 3 |
| 25. | file.exe | 5ee9c9da29774358656354302309b2a9 | 2 |
| 26. | 83e3167b6d6000037411bc720b9e1224.exe | d60bd321c043695ae67c0b630d5ab85c | 2 |
| 27. | 3409dfc64132b6ba26c828455e34860f.exe | d9d919762f8c1e45978a72b5a3992863 | 2 |
| 28. | 50a6ceecce3b6e575a63bbcea6a2bd9e.exe | bdfe70f9e4ab1b1437f130ebc2afd08c | 2 |
| 29. | 3098dbecbe29b36c4c0e9641f6559743.exe | 038b69aee6c4f0d6585e11cb3db633d6 | 2 |
| 30. | de8b5941a480a52b8514ae10547ac51a.exe | 1d22c58f5ea666a3409b0d044a83cb22 | 2 |
Registry Details
Backdoor.Bladabindi may create the following registry entry or registry entries:
Regexp file mask
%ALLUSERSPROFILE%\images[RANDOM CHARACTERS].exe
%ALLUSERSPROFILE%\smss.exe
%ALLUSERSPROFILE%\System.exe
%ALLUSERSPROFILE%\system32.exe
%APPDATA%\ Explorer.exe
%APPDATA%\.pif
%APPDATA%\Documento Pdf.exe
%APPDATA%\GoogleCrashHandler.exe
%APPDATA%\Java\JavaUpdtr.exe
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Server.exe
%APPDATA%\Microsoft\Windows\Start Menu\Startup\DetaUp.exe
%APPDATA%\trof.exe
%APPDATA%\WindowsServices.exe
%APPDATA%\wored.exe
%HOMEDRIVE%\Java update.exe
%HOMEDRIVE%\svchost.exe
%TEMP%\ Explorer.exe
%TEMP%\audiodef.exe
%TEMP%\sam.exe
%USERPROFILE%\google.exe
%USERPROFILE%\svchost.exe
%USERPROFILE%\system[NUMBERS].exe
%WINDIR%\win32.exe
SOFTWARE\e936a10f968ac948cd351c9629dbd36d
SOFTWARE\Microsoft\Tracing\JavaUpdtr_RASMANCS
SOFTWARE\Wow6432Node\Microsoft\Tracing\JavaUpdtr_RASMANCS
Analysis Report
General information
| Family Name: | Backdoor.Bladabindi |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
16e5a665127117c3ad242fe9c8fa51cf
SHA1:
d0bfc0b363c7cae87228dc1152fc626b4a7ff4e5
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
1278baee347e6742d752da98dc98c949
SHA1:
b536f993ab063eecb063b2fda7626eae965edfb2
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
97a0552e5802d3db22e151c9ad9b07b7
SHA1:
fd4b002ab7b7481b2eb54e6992ace7e8e5fdb57f
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
bc117d620b623485646c68a56d4ed40d
SHA1:
5f790cf8599738bffcf8ec75348e68648d382cc2
SHA256:
989DDBBFC1AC728F6B05FFA2030B050C114955C2DDFB67BB1C984720B63D449E
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
923dcd09fb655bb00710181695d41e49
SHA1:
295f404c9c21c87371e771ac2874c56ff196261d
SHA256:
37CDDDE2BF487B139ECA6A9B3F6DC0F2E03F2C22247368BE7F72718413E072A5
File Size:
32.77 KB, 32768 bytes
|
Show More
|
MD5:
088ddab1269b52c97e984d44b776184c
SHA1:
c070af3403bc93b882f194e357d3ea6e6f0f28f6
SHA256:
B047134DEE98663D27DE7717724A5F1A2471BE25B1B229328CE1FB1581378718
File Size:
82.43 KB, 82432 bytes
|
|
MD5:
1388ce0db733fae88e9f90a965751767
SHA1:
fcc3a19573ebacb838431cb93dbc992c7cbce059
SHA256:
6FECD4FAC74665BE3D197F6CBC21C30361872B46D9161A3B430281C30F45E9BA
File Size:
88.06 KB, 88064 bytes
|
|
MD5:
615bf2c36e04495828dd28cffdaf31b8
SHA1:
29e2db8d4f037fbe2129fe391846b1eafa4de585
SHA256:
8E93357BC288A204596110FA366087E1DFDCC0025825046829C6F96629C8D97A
File Size:
132.10 KB, 132096 bytes
|
|
MD5:
4a325c8ffc5778aeb2cd052db9660460
SHA1:
894c737c07176d255a021d74b186c5e1a5c3bd1a
SHA256:
270CB247D85CE330853F47DAF01E7D5CDBF93ACC56EB4CCF4E1F9C93CB43A1E1
File Size:
12.80 KB, 12800 bytes
|
|
MD5:
e01fa91d82f1811606e2f45d46dfdcea
SHA1:
31cb631342f3ff0a4577dfa2d0f23ddca4d3964d
SHA256:
4F970CF2A437FDEEF55AA12522FC92873496B9B70EFF7F954CDE0FCD030700E7
File Size:
30.72 KB, 30720 bytes
|
|
MD5:
eedb3a56d41a0f919daf5ef0bf5c1b42
SHA1:
73e6365acb5d2ea5182ac983f848af24cc4df09f
SHA256:
78D25E20E97C5277C180B1184463CA6AC71B1782DE531152912DEB296ED02F50
File Size:
91.14 KB, 91136 bytes
|
|
MD5:
db054ba31579107bab0c3465881f2a67
SHA1:
6a43cb71e8691e50025e59f13b009d2cd2a53e72
SHA256:
34665D0EF0E8F93065EDD18E3A60DC5D15581F82F753AB4BBC3B390D6D0BE187
File Size:
32.77 KB, 32768 bytes
|
|
MD5:
9611cdcfbef47cb6443cff375d819c73
SHA1:
c5620a281e8e7ff76c4352fff6fef3453e32e0ee
SHA256:
F2FFEA07EDBE0C6D96BFE9454C99DAA0BCCBC0ACC72E366AE10D9302D3AED887
File Size:
12.80 KB, 12800 bytes
|
|
MD5:
cca26e07d762472e00bbc12b7a725a59
SHA1:
babe518dac866d6fc9549cc8c2bfe70e9a24aad5
SHA256:
E0643BDDF9076A476B8C59C6AC5AFE231AF87C028AD4552ABF7B3398E84AC6BB
File Size:
29.70 KB, 29696 bytes
|
|
MD5:
576a8795bfd07f0400bafc172274a012
SHA1:
61f9ed0ecfac23714ba124e65fdcbee2a9ea8ba7
SHA256:
EDBE593AB0CF45250EB6A6EFACA57185321A8C5BDF5166C5350E32CC0EBCDADB
File Size:
44.54 KB, 44544 bytes
|
|
MD5:
bf35a7b7f90f250cc6c39513fac7f4c0
SHA1:
367cf91fe2ec37cb1e1d3dd6f1b542063a247921
SHA256:
C16F6F097BA25ECD0540C860E7494565229B8BCF3F6B9D882D82AAA8515B68EB
File Size:
7.97 MB, 7973448 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Company Name | Sand Studio |
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks | AirDroid |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| SAND STUDIO CORPORATION LIMITED | Sectigo Public Code Signing Root R46 | Root Not Trusted |
File Traits
- .NET
- dll
- HighEntropy
- NewLateBinding
- No Version Info
- ntdll
- RijndaelManaged
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 404 |
|---|---|
| Potentially Malicious Blocks: | 9 |
| Whitelisted Blocks: | 243 |
| Unknown Blocks: | 152 |
Visual Map
0
0
0
0
?
?
?
0
?
0
0
0
0
0
?
0
?
?
?
?
?
?
?
?
0
?
?
0
0
?
?
0
?
0
?
0
0
?
?
0
?
0
?
0
x
?
?
?
?
0
?
0
?
0
?
0
0
0
?
?
?
?
?
?
0
?
?
?
x
0
?
0
?
?
?
?
0
0
?
0
0
?
?
?
0
?
?
?
?
?
0
?
0
?
?
0
0
0
0
?
0
0
0
0
?
0
0
0
?
0
0
0
?
?
?
0
?
?
0
?
?
?
?
?
?
0
?
?
?
?
0
0
0
?
?
?
?
0
0
?
?
?
0
?
0
0
?
0
?
0
?
0
0
0
0
0
0
0
0
0
?
?
0
0
?
0
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
0
?
0
0
0
?
0
0
0
?
?
?
x
?
?
?
?
?
?
?
?
?
0
x
?
0
x
0
0
?
0
x
0
?
?
0
0
0
0
0
0
?
0
?
0
?
0
?
?
?
?
x
?
0
0
0
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
x
?
0
0
?
?
?
?
?
?
0
0
0
0
0
?
?
?
?
?
?
0
?
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\svchost.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\svchost.exe | Generic Write,Read Attributes,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\svchost.exe | Generic Write,Read Data,Read Attributes,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\svchost.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\hkcmd.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\3c67905b3c2f29273f8e24b6e3d2a9a4.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\3c67905b3c2f29273f8e24b6e3d2a9a4.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\5afe10dbcec7d8a1b53abb0a4a679d2c.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\5afe10dbcec7d8a1b53abb0a4a679d2c.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\{ddfrcxat-292328-kkmyjd-kkmyjdh1fi}.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
Show More
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\{ddfrcxat-292328-kkmyjd-kkmyjdh1fi}.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\systen32.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU::di | ! | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沍 䠱O᤹˃噀ñĤʁ뽹ɞ傄ë駃óߙĤ É | RegNtPreCreateKey |
| HKCU\software\{ddfrcxat-292328-kkmyjd-kkmyjdh1fi}::h | MTI3LjAuMC4xOjIwNjY5LA== | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 㵖 ȁ 獖} | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沊 䠱O᤹˃噀ñĤ뽹ɞ傄ë鶝駃óߙĤ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沋 䠱O᤹˃噀ñĤ뽹ɞ傄ëķ鶝駃ó䧌VߙĤ⣳ġj 鈄ĞꩠŖ | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沌 䠱O᤹˃噀ñĤ뽹ɞ傄ëķ鶝淃駃ó䧌VߙĤ⣳ġj 鈄ĞꩠŖ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沍 䠱O᤹˃噀ñĤ뽹ɞ傄ëķ鶝閾ʴ淃駃ó⟋ʪ䧌VߙĤ⣳ġj 鈄ĞꩠŖ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\run::{ddfrcxat-292328-kkmyjd-kkmyjdh1fi} | "C:\Users\Aacjhuxh\AppData\Local\Temp\svchost.exe" ... | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKCU\environment::see_mask_nozonechecks | 1 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 拀⏬ꕠǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\run::5afe10dbcec7d8a1b53abb0a4a679d2c | "C:\Users\Ezavswub\AppData\Roaming\Systen32.exe" .. | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\run::5afe10dbcec7d8a1b53abb0a4a679d2c | "C:\Users\Ezavswub\AppData\Roaming\Systen32.exe" .. | RegNtPreCreateKey |
| HKCU\local settings\muicache\1b\52c64b7e::@c:\windows\system32\firewallcontrolpanel.dll,-12122 | Windows Defender Firewall | RegNtPreCreateKey |
| HKCU\software\3c67905b3c2f29273f8e24b6e3d2a9a4::hp | Y29ycm01MzE5LmRkbnMubmV0OjU1NTIs | RegNtPreCreateKey |
| HKCU\software\3c67905b3c2f29273f8e24b6e3d2a9a4::i | ! | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 瀞ꈌǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\run::3c67905b3c2f29273f8e24b6e3d2a9a4 | "C:\Users\Bptqwiaw\AppData\Roaming\hkcmd.exe" .. | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\run::3c67905b3c2f29273f8e24b6e3d2a9a4 | "C:\Users\Bptqwiaw\AppData\Roaming\hkcmd.exe" .. | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 闸 ȁ ਪˣ 鈯ˣ 遙̃ 豤̃ অˣ 炑̃ 龡^ 濖̃ 賬̃ 폾z 獖} 鰚² ˣ 邯̃ 뫯ʃ 좟Êe ᐊ 엦1 ¶} ꙥ ꙥ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 鉟ᜁ뎘ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\run::ba4c12bee3027d94da5c81db2d196bfd | "C:\Users\Jdsqogtl\AppData\Local\Temp\svchost.exe" .. | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\run::ba4c12bee3027d94da5c81db2d196bfd | "C:\Users\Jdsqogtl\AppData\Local\Temp\svchost.exe" .. | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Keyboard Access |
|
| Anti Debug |
|
| Other Suspicious |
|
| Encryption Used |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Process Manipulation Evasion |
|
| Service Control |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c070af3403bc93b882f194e357d3ea6e6f0f28f6_0000082432.,LiQMAxHB
|
(NULL) C:\Users\Aacjhuxh\AppData\Local\Temp\svchost.exe
|
(NULL) C:\Users\Ezavswub\AppData\Roaming\Systen32.exe
|
netsh firewall add allowedprogram "C:\Users\Ezavswub\AppData\Roaming\Systen32.exe" "Systen32.exe" ENABLE
|
(NULL) C:\Users\Bptqwiaw\AppData\Roaming\hkcmd.exe
|
Show More
netsh firewall add allowedprogram "C:\Users\Bptqwiaw\AppData\Roaming\hkcmd.exe" "hkcmd.exe" ENABLE
|
(NULL) C:\Users\Jdsqogtl\AppData\Local\Temp\svchost.exe
|
netsh firewall add allowedprogram "C:\Users\Jdsqogtl\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\367cf91fe2ec37cb1e1d3dd6f1b542063a247921_0007973448.,LiQMAxHB
|
