File name:

0261C4651CE6A438972A21B0799ED7D3.exe

Full analysis: https://app.any.run/tasks/e5bf8ec7-b8c8-4b15-a1d1-cff630b88541
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: July 15, 2025, 14:11:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
rat
njrat
bladabindi
remote
backdoor
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

0261C4651CE6A438972A21B0799ED7D3

SHA1:

572474BEEB3A3D483821E867A2E7EBBAF6294C43

SHA256:

C48E1D76F8E3DCBFA247F2BC6478F31ED9684015AA22ABCEA762BE6504983833

SSDEEP:

393216:7zg4omJmWTVNTz40bKNyVrDDPDa0HkVgOLOF8IlOMUTMV2nYoN33553NSsj:7zgdO7zRPDrDa0HdOqocYnL3JZ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Server.exe (PID: 1604)

    • NJRAT has been detected (YARA)

      • Server.exe (PID: 1604)

    • NJRAT has been detected (SURICATA)

      • Server.exe (PID: 1604)

    • Connects to the CnC server

      • Server.exe (PID: 1604)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ZapretSetup (1).exe (PID: 3864)
      • 0261C4651CE6A438972A21B0799ED7D3.exe (PID: 3888)
      • ZapretSetup (1).exe (PID: 1752)
      • ZapretSetup (1).tmp (PID: 1712)
      • Server.exe (PID: 1604)

    • Reads security settings of Internet Explorer

      • 0261C4651CE6A438972A21B0799ED7D3.exe (PID: 3888)
      • ZapretSetup (1).tmp (PID: 504)

    • Reads the Windows owner or organization settings

      • ZapretSetup (1).tmp (PID: 1712)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Server.exe (PID: 1604)

    • Probably fake Windows Update file has been dropped

      • Server.exe (PID: 1604)

    • Creates file in the systems drive root

      • Server.exe (PID: 1604)

    • Probably fake Windows Update

      • 576a05b879f6ab41f3be0b4cc1dea691Windows Update.exe (PID: 5924)

    • Contacting a server suspected of hosting an CnC

      • Server.exe (PID: 1604)

  • INFO

    • Reads the computer name

      • 0261C4651CE6A438972A21B0799ED7D3.exe (PID: 3888)
      • ZapretSetup (1).tmp (PID: 504)
      • Server.exe (PID: 1604)
      • ZapretSetup (1).exe (PID: 1752)
      • ZapretSetup (1).tmp (PID: 1712)
      • Microsoft Corporation.exe (PID: 6404)
      • Explower.exe (PID: 5560)

    • Checks supported languages

      • 0261C4651CE6A438972A21B0799ED7D3.exe (PID: 3888)
      • ZapretSetup (1).exe (PID: 3864)
      • Server.exe (PID: 1604)
      • ZapretSetup (1).tmp (PID: 504)
      • ZapretSetup (1).exe (PID: 1752)
      • ZapretSetup (1).tmp (PID: 1712)
      • Microsoft Corporation.exe (PID: 6404)
      • Explower.exe (PID: 5560)

    • Create files in a temporary directory

      • 0261C4651CE6A438972A21B0799ED7D3.exe (PID: 3888)
      • ZapretSetup (1).exe (PID: 3864)
      • Server.exe (PID: 1604)
      • ZapretSetup (1).tmp (PID: 1712)
      • Microsoft Corporation.exe (PID: 6404)
      • Explower.exe (PID: 5560)
      • ZapretSetup (1).exe (PID: 1752)

    • Process checks computer location settings

      • 0261C4651CE6A438972A21B0799ED7D3.exe (PID: 3888)
      • ZapretSetup (1).tmp (PID: 504)

    • Creates files or folders in the user directory

      • Server.exe (PID: 1604)

    • Failed to create an executable file in Windows directory

      • Server.exe (PID: 1604)

    • Launching a file from the Startup directory

      • Server.exe (PID: 1604)

    • Manual execution by a user

      • Microsoft Corporation.exe (PID: 6404)
      • Explower.exe (PID: 5560)
      • 576a05b879f6ab41f3be0b4cc1dea691Windows Update.exe (PID: 5924)

    • Compiled with Borland Delphi (YARA)

      • ZapretSetup (1).exe (PID: 3864)
      • ZapretSetup (1).tmp (PID: 504)
      • ZapretSetup (1).exe (PID: 1752)
      • ZapretSetup (1).tmp (PID: 1712)

    • Detects InnoSetup installer (YARA)

      • ZapretSetup (1).exe (PID: 3864)
      • ZapretSetup (1).tmp (PID: 504)
      • ZapretSetup (1).exe (PID: 1752)
      • ZapretSetup (1).tmp (PID: 1712)

    • Reads the machine GUID from the registry

      • Server.exe (PID: 1604)

    • Reads the software policy settings

      • slui.exe (PID: 4172)

    • Checks proxy server information

      • slui.exe (PID: 4172)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(1604) Server.exe
C2141.8.198.169
Ports8080
Botnetprimat
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\576a05b879f6ab41f3be0b4cc1dea691
Splitter|'|'|
Version0.7d
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:06:15 16:44:28+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 3584
InitializedDataSize: 56400384
UninitializedDataSize: -
EntryPoint: 0x1ae1
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
12
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 0261c4651ce6a438972a21b0799ed7d3.exe zapretsetup (1).exe #NJRAT server.exe zapretsetup (1).tmp no specs zapretsetup (1).exe zapretsetup (1).tmp netsh.exe no specs conhost.exe no specs microsoft corporation.exe no specs 576a05b879f6ab41f3be0b4cc1dea691windows update.exe no specs explower.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
504"C:\Users\admin\AppData\Local\Temp\is-9CFGO.tmp\ZapretSetup (1).tmp" /SL5="$70282,55651689,816128,C:\Users\admin\AppData\Local\Temp\ZapretSetup (1).exe" C:\Users\admin\AppData\Local\Temp\is-9CFGO.tmp\ZapretSetup (1).tmp—ZapretSetup (1).exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-9cfgo.tmp\zapretsetup (1).tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1604"C:\Users\admin\AppData\Local\Temp\Server.exe" C:\Users\admin\AppData\Local\Temp\Server.exe
0261C4651CE6A438972A21B0799ED7D3.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
NjRat
(PID) Process(1604) Server.exe
C2141.8.198.169
Ports8080
Botnetprimat
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\576a05b879f6ab41f3be0b4cc1dea691
Splitter|'|'|
Version0.7d
1712"C:\Users\admin\AppData\Local\Temp\is-JINAB.tmp\ZapretSetup (1).tmp" /SL5="$70374,55651689,816128,C:\Users\admin\AppData\Local\Temp\ZapretSetup (1).exe" /SPAWNWND=$50306 /NOTIFYWND=$70282 C:\Users\admin\AppData\Local\Temp\is-JINAB.tmp\ZapretSetup (1).tmp
ZapretSetup (1).exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jinab.tmp\zapretsetup (1).tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1752"C:\Users\admin\AppData\Local\Temp\ZapretSetup (1).exe" /SPAWNWND=$50306 /NOTIFYWND=$70282 C:\Users\admin\AppData\Local\Temp\ZapretSetup (1).exe
ZapretSetup (1).tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Zapret Setup
Version:
Modules
Images
c:\users\admin\appdata\local\temp\zapretsetup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
3864"C:\Users\admin\AppData\Local\Temp\ZapretSetup (1).exe" C:\Users\admin\AppData\Local\Temp\ZapretSetup (1).exe
0261C4651CE6A438972A21B0799ED7D3.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Zapret Setup
Version:
Modules
Images
c:\users\admin\appdata\local\temp\zapretsetup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
3888"C:\Users\admin\AppData\Local\Temp\0261C4651CE6A438972A21B0799ED7D3.exe" C:\Users\admin\AppData\Local\Temp\0261C4651CE6A438972A21B0799ED7D3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\0261c4651ce6a438972a21b0799ed7d3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
4172C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5560"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\explower.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5924"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\576a05b879f6ab41f3be0b4cc1dea691Windows Update.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\576a05b879f6ab41f3be0b4cc1dea691Windows Update.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\576a05b879f6ab41f3be0b4cc1dea691windows update.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6376netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLEC:\Windows\SysWOW64\netsh.exe—Server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
2 282
Read events
2 281
Write events
1
Delete events
0

Modification events

(PID) Process:(1604) Server.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
Executable files
14
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
38880261C4651CE6A438972A21B0799ED7D3.exeC:\Users\admin\AppData\Local\Temp\ZapretSetup (1).exe —
MD5:—
SHA256:—
1604Server.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Explower.exeexecutable
MD5:8C279D6410F6EEB409164B37122B8B1A
SHA256:489D3B358343BFF8C086F7BE99E06DE926CC7DDD3915C41E9A6212687F8C7D45
3864ZapretSetup (1).exeC:\Users\admin\AppData\Local\Temp\is-9CFGO.tmp\ZapretSetup (1).tmpexecutable
MD5:2640A6528952D4D05871AAC0B6405604
SHA256:F97C84C217A318627BCAE376CB718135945D6536DF65D171718485E57E46526C
1752ZapretSetup (1).exeC:\Users\admin\AppData\Local\Temp\is-JINAB.tmp\ZapretSetup (1).tmpexecutable
MD5:2640A6528952D4D05871AAC0B6405604
SHA256:F97C84C217A318627BCAE376CB718135945D6536DF65D171718485E57E46526C
1604Server.exeC:\Users\admin\AppData\Roaming\apptext
MD5:AA3CCE4F6C83D5ADFCFC45934B274CC6
SHA256:57A8FF317E913B7E08C0A1758997ED0FFC2F1ABA0A3B3310C7697BC207FD15E5
1604Server.exeC:\Users\admin\Desktop\Explower.exeexecutable
MD5:8C279D6410F6EEB409164B37122B8B1A
SHA256:489D3B358343BFF8C086F7BE99E06DE926CC7DDD3915C41E9A6212687F8C7D45
1604Server.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exeexecutable
MD5:8C279D6410F6EEB409164B37122B8B1A
SHA256:489D3B358343BFF8C086F7BE99E06DE926CC7DDD3915C41E9A6212687F8C7D45
1604Server.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\576a05b879f6ab41f3be0b4cc1dea691Windows Update.exeexecutable
MD5:8C279D6410F6EEB409164B37122B8B1A
SHA256:489D3B358343BFF8C086F7BE99E06DE926CC7DDD3915C41E9A6212687F8C7D45
1604Server.exeC:\Users\admin\AppData\Local\Explower.exeexecutable
MD5:8C279D6410F6EEB409164B37122B8B1A
SHA256:489D3B358343BFF8C086F7BE99E06DE926CC7DDD3915C41E9A6212687F8C7D45
1604Server.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCookies\Explower.exeexecutable
MD5:8C279D6410F6EEB409164B37122B8B1A
SHA256:489D3B358343BFF8C086F7BE99E06DE926CC7DDD3915C41E9A6212687F8C7D45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
50
DNS requests
15
Threats
84

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6140
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6140
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2552
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2324
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1604
Server.exe
141.8.198.169:8080
—
Sprinthost.ru LLC
RU
malicious
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6140
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.29
  • 23.216.77.41
  • 23.216.77.31
  • 23.216.77.35
  • 23.216.77.34
  • 23.216.77.30
  • 23.216.77.39
  • 23.216.77.38
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.138
  • 20.190.160.3
  • 20.190.160.132
  • 20.190.160.131
  • 40.126.32.68
  • 20.190.160.5
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
x1.c.lencr.org
  • 23.209.209.135
whitelisted

Threats

PID
Process
Class
Message
1604
Server.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
1604
Server.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
1604
Server.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
1604
Server.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
1604
Server.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
1604
Server.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
1604
Server.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
1604
Server.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
1604
Server.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
1604
Server.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0261C4651CE6A438972A21B0799ED7D3.exe