Trojan.Bladabindi
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 5,308 |
| Threat Level: | 60 % (Medium) |
| Infected Computers: | 105,756 |
| First Seen: | May 1, 2013 |
| Last Seen: | November 28, 2025 |
| OS(es) Affected: | Windows |
Trojan.Bladabindi is a Trojan that may execute harmful actions on the corrupted PC. Trojan.Bladabindi attacks Windows PCs. Trojan.Bladabindi is a security risk to the victimized computer system and the target PC user's privacy. Trojan.Bladabindi may access the compromised PC through security holes, or may invade the vulnerable computer via removable devices like infected USB drives. Trojan.Bladabindi can result in computer functionality issues and incorporate the PC into numerous illicit actions. Trojan.Bladabindi can disguise itself on the attacked PC and attempt to bypass the detection and extermination of anti-virus programs by using the original names of genuine Windows files. Trojan.Bladabindi can destroy the vulnerable PC, use personal accounts or drop other PC infections.
Table of Contents
Aliases
15 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| Ikarus | not-a-virus:RiskTool.Win32.BitCoinMiner |
| Sophos | Bitcoin Miner |
| Kaspersky | not-a-virus:RiskTool.Win32.BitCoinMiner.cns |
| AVG | Generic32.CKXR |
| Sophos | Troj/Agent-ABNT |
| Kaspersky | Trojan.Win32.Redyms.pix |
| Avast | Win32:Rootkit-gen [Rtk] |
| Panda | Trj/Genetic.gen |
| AVG | Crypt_s.AVA |
| Ikarus | Trojan.Crypt_s |
| AhnLab-V3 | Dropper/Win32.Clons |
| AntiVir | TR/Crypt.TPM.Gen |
| Comodo | Backdoor.Win32.Agent.SPA |
| Kaspersky | Trojan-Dropper.Win32.Clons.zzx |
| F-Prot | W32/Boaxxe.F2.gen!Eldorado |
SpyHunter Detects & Remove Trojan.Bladabindi
File System Details
Trojan.Bladabindi may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | c5dbc4b5114eccb1261dfdb2194089a8.exe | 52e8d405637fbd963055823c15f0f9a1 | 144 |
| 2. | 48d63ee9bfd6d65c02373667cd2c8697.exe | 71fb65eb058f3eec32c74a04a78e831c | 61 |
| 3. | 5f805e177fa7c673482c92c255460b67.exe | d313b3409a30ce1040ce3d010f4e4b99 | 39 |
| 4. | 017896e94ee32e077c688af9a248e03f.exe | dc45685c7921768488485c054a5562b0 | 25 |
| 5. | 56950d8c4bc04b6faabb3fd849300f81.exe | e0d78fe03901a9a7d6b2bdae3c14cb72 | 19 |
| 6. | 7a4c1aa1519c6bee178f8fbf3ccffa01.exe | fecb975fe7b949c414640a3ff2cbae88 | 15 |
| 7. | e7519346edbd1261bb7e4084fb50cd6b.exe | e4396258e2a50828a318f2d35785d93d | 14 |
| 8. | 58c6ed6a71daea3cb58e4fa06beab2bd.exe | 3a101e54c316fbf58778c71dda9299e5 | 12 |
| 9. | 3008b25cd890618ead84115e2b073a47.exe | fd21ff54f5a33b5b37260814d0731c2a | 11 |
| 10. | troj_generic_ebc5a6b5083f5b9a0d2e2aadfd2daa3d3697a23461c0cc40ff347672c75767d0.exe | d682acc4b6eae500dc3c908dbaedf519 | 10 |
| 11. | a0bd4888d482d751fa2518c73e7d2a9f.exe | 5a33c50a8117f87ae4ef0da3bacfb12d | 10 |
| 12. | 62b4a7f32364bd20762dd3b30db01d93.exe | 09d66712ca96bd1a7d627e66c60b2b9c | 9 |
| 13. | cc6885fb771802b45c9dcc628f9ad989.exe | de479c9e92ecc1ac8447901cdce64bce | 8 |
| 14. | 5db5c656e6f615eba326e0e421c56c58.exe | 270c797a677b22b3f768350412969936 | 7 |
| 15. | 79c3667e6e3ee30e7cbb11fd90ef9fe4.exe | fa3c14ca50dbc11e58800f1bdf462f5f | 7 |
| 16. | 3565237e66224ab2498e196ce0aff5cd.exe | 522848c65ceb2f2acb9fcfb2e99a94e6 | 7 |
| 17. | 69b5b7ca364f50a6f2ca0f32b9e3c064.exe | 4c721d10ff63f1ec9bb0415a4a7a5c0e | 7 |
| 18. | a5ab2dbc68c601545cd9a9946ac0b01c.exe | 3715f2a674f9b3996b0309724188aa73 | 6 |
| 19. | 9f192a1f8ea7e654ab7f4f6227bc120c.exe | 3770847fb83d43a0fa2c2a9cff45202f | 5 |
| 20. | f683abc40afcb2fb0f4a33d15709c9b7.exe | 09604a0cc24b679da7cf9b2c0d576410 | 5 |
| 21. | 7d4366b7a274f87b26c436a0e40a9090.exe | d62a817ace66b957d2602656b78d142f | 4 |
| 22. | db87ad7e45211040c408f1ad355e0739.exe | 9c809e09d971aab8c42f77f4fb5effd4 | 3 |
| 23. | adf954c8b8af53ba18232ab9e7f642d4.exe | c797a3bf5ed730a47d8324aed964bcc4 | 3 |
| 24. | 163ea917cb09d012dda3841f98d3c236.exe | 78c6b9e3ad95a1715d7c2a129c0b65e2 | 3 |
| 25. | file.exe | 5ee9c9da29774358656354302309b2a9 | 2 |
| 26. | 83e3167b6d6000037411bc720b9e1224.exe | d60bd321c043695ae67c0b630d5ab85c | 2 |
| 27. | 3409dfc64132b6ba26c828455e34860f.exe | d9d919762f8c1e45978a72b5a3992863 | 2 |
| 28. | 50a6ceecce3b6e575a63bbcea6a2bd9e.exe | bdfe70f9e4ab1b1437f130ebc2afd08c | 2 |
| 29. | 3098dbecbe29b36c4c0e9641f6559743.exe | 038b69aee6c4f0d6585e11cb3db633d6 | 2 |
| 30. | de8b5941a480a52b8514ae10547ac51a.exe | 1d22c58f5ea666a3409b0d044a83cb22 | 2 |
Registry Details
Trojan.Bladabindi may create the following registry entry or registry entries:
Regexp file mask
%ALLUSERSPROFILE%\images[RANDOM CHARACTERS].exe
%ALLUSERSPROFILE%\smss.exe
%ALLUSERSPROFILE%\System.exe
%ALLUSERSPROFILE%\system32.exe
%APPDATA%\ Explorer.exe
%APPDATA%\.pif
%APPDATA%\Documento Pdf.exe
%APPDATA%\GoogleCrashHandler.exe
%APPDATA%\Java\JavaUpdtr.exe
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Server.exe
%APPDATA%\Microsoft\Windows\Start Menu\Startup\DetaUp.exe
%APPDATA%\trof.exe
%APPDATA%\WindowsServices.exe
%APPDATA%\wored.exe
%HOMEDRIVE%\Java update.exe
%HOMEDRIVE%\svchost.exe
%TEMP%\ Explorer.exe
%TEMP%\audiodef.exe
%TEMP%\sam.exe
%USERPROFILE%\google.exe
%USERPROFILE%\svchost.exe
%USERPROFILE%\system[NUMBERS].exe
%WINDIR%\win32.exe
SOFTWARE\e936a10f968ac948cd351c9629dbd36d
SOFTWARE\Microsoft\Tracing\JavaUpdtr_RASMANCS
SOFTWARE\Wow6432Node\Microsoft\Tracing\JavaUpdtr_RASMANCS
Analysis Report
General information
| Family Name: | Backdoor.Bladabindi |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
16e5a665127117c3ad242fe9c8fa51cf
SHA1:
d0bfc0b363c7cae87228dc1152fc626b4a7ff4e5
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
1278baee347e6742d752da98dc98c949
SHA1:
b536f993ab063eecb063b2fda7626eae965edfb2
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
97a0552e5802d3db22e151c9ad9b07b7
SHA1:
fd4b002ab7b7481b2eb54e6992ace7e8e5fdb57f
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
bc117d620b623485646c68a56d4ed40d
SHA1:
5f790cf8599738bffcf8ec75348e68648d382cc2
SHA256:
989DDBBFC1AC728F6B05FFA2030B050C114955C2DDFB67BB1C984720B63D449E
File Size:
44.03 KB, 44032 bytes
|
|
MD5:
923dcd09fb655bb00710181695d41e49
SHA1:
295f404c9c21c87371e771ac2874c56ff196261d
SHA256:
37CDDDE2BF487B139ECA6A9B3F6DC0F2E03F2C22247368BE7F72718413E072A5
File Size:
32.77 KB, 32768 bytes
|
Show More
|
MD5:
088ddab1269b52c97e984d44b776184c
SHA1:
c070af3403bc93b882f194e357d3ea6e6f0f28f6
SHA256:
B047134DEE98663D27DE7717724A5F1A2471BE25B1B229328CE1FB1581378718
File Size:
82.43 KB, 82432 bytes
|
|
MD5:
1388ce0db733fae88e9f90a965751767
SHA1:
fcc3a19573ebacb838431cb93dbc992c7cbce059
SHA256:
6FECD4FAC74665BE3D197F6CBC21C30361872B46D9161A3B430281C30F45E9BA
File Size:
88.06 KB, 88064 bytes
|
|
MD5:
615bf2c36e04495828dd28cffdaf31b8
SHA1:
29e2db8d4f037fbe2129fe391846b1eafa4de585
SHA256:
8E93357BC288A204596110FA366087E1DFDCC0025825046829C6F96629C8D97A
File Size:
132.10 KB, 132096 bytes
|
|
MD5:
4a325c8ffc5778aeb2cd052db9660460
SHA1:
894c737c07176d255a021d74b186c5e1a5c3bd1a
SHA256:
270CB247D85CE330853F47DAF01E7D5CDBF93ACC56EB4CCF4E1F9C93CB43A1E1
File Size:
12.80 KB, 12800 bytes
|
|
MD5:
e01fa91d82f1811606e2f45d46dfdcea
SHA1:
31cb631342f3ff0a4577dfa2d0f23ddca4d3964d
SHA256:
4F970CF2A437FDEEF55AA12522FC92873496B9B70EFF7F954CDE0FCD030700E7
File Size:
30.72 KB, 30720 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| File Description | Keylogger |
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name | Keylogger |
| Product Version |
|
File Traits
- .NET
- dll
- NewLateBinding
- No Version Info
- ntdll
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 63 |
|---|---|
| Potentially Malicious Blocks: | 8 |
| Whitelisted Blocks: | 30 |
| Unknown Blocks: | 25 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
?
?
x
?
?
?
?
?
?
?
?
x
?
?
?
?
?
0
0
0
0
?
x
x
x
x
0
x
x
?
?
?
?
?
?
?
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\svchost.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\svchost.exe | Generic Write,Read Attributes,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\svchost.exe | Generic Write,Read Data,Read Attributes,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\svchost.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\{ddfrcxat-292328-kkmyjd-kkmyjdh1fi}.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\{ddfrcxat-292328-kkmyjd-kkmyjdh1fi}.exe | Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU::di | ! | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沍 䠱O᤹˃噀ñĤʁ뽹ɞ傄ë駃óߙĤ É | RegNtPreCreateKey |
| HKCU\software\{ddfrcxat-292328-kkmyjd-kkmyjdh1fi}::h | MTI3LjAuMC4xOjIwNjY5LA== | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 㵖 ȁ 獖} | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沊 䠱O᤹˃噀ñĤ뽹ɞ傄ë鶝駃óߙĤ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沋 䠱O᤹˃噀ñĤ뽹ɞ傄ëķ鶝駃ó䧌VߙĤ⣳ġj 鈄ĞꩠŖ | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沌 䠱O᤹˃噀ñĤ뽹ɞ傄ëķ鶝淃駃ó䧌VߙĤ⣳ġj 鈄ĞꩠŖ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 沍 䠱O᤹˃噀ñĤ뽹ɞ傄ëķ鶝閾ʴ淃駃ó⟋ʪ䧌VߙĤ⣳ġj 鈄ĞꩠŖ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\run::{ddfrcxat-292328-kkmyjd-kkmyjdh1fi} | "C:\Users\Aacjhuxh\AppData\Local\Temp\svchost.exe" ... | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Keyboard Access |
|
| Anti Debug |
|
| Other Suspicious |
|
| Encryption Used |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c070af3403bc93b882f194e357d3ea6e6f0f28f6_0000082432.,LiQMAxHB
|
(NULL) C:\Users\Aacjhuxh\AppData\Local\Temp\svchost.exe
|
