Analysis date (UTC): 6 April 2026, 22:57Analysis environment: Windows 10 Pro, build 19044, x64

_ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe

MD5:129DF3C4DCAAE4C1860A334BE50F2ED3
SHA1:4CDA77BC5D5C136C4A5A19122FD378B045CC7DEE
SHA256:FF87CD932E25B024CD10042C186F252FDABDAC2C4D4CBC67F89E457697EBBC71

Analysis result

Behavior activities

MALICIOUS

NjRAT is detected

  • _ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe (PID: 7176)

NJRAT has been detected (YARA)

  • _ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe (PID: 7176)

NJRAT has been detected (SURICATA)

  • _ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe (PID: 7176)

SUSPICIOUS

Uses NETSH.EXE to add a firewall rule or allowed programs

  • _ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe (PID: 7176)

Contacting a server suspected of hosting an CnC

  • _ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe (PID: 7176)

INFO

Reads the machine GUID from the registry

  • _ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe (PID: 7176)

Checks supported languages

  • _ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe (PID: 7176)

Reads the computer name

  • _ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exe (PID: 7176)

Threats

PIDProcessClassMessage
7176_ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exeMalware Command and Control Activity DetectedBACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
7176_ff87cd932e25b024cd10042c186f252fdabdac2c4d4cbc67f89e457697ebbc71.exeMalware Command and Control Activity DetectedET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN