MALICIOUS — 03d2e8ef968a70c032ffb01c98b29ab612ae48043b44e63d15c2504f7f85de13.exe

MALICIOUS — 03d2e8ef968a70c032ffb01c98b29ab612ae48043b44e63d15c2504f7f85de13.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bladabindi family. 9 of 53 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 03d2e8ef968a70c032ffb01c98b29ab612ae48043b44e63d15c2504f7f85de13
SHA-1: d0b31bfd1d8e40efc3b3b30c1cf9b655c9365935
MD5: 0f74892809973a93321c7ba05bdf61ca
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 768:mRCLqdzNB0zx/6LyTmvUXdvMxQmIDUu0ti6Qj:R6KbpIQVkyj
TLSH: T10B2E29D9085C2768D07FBD621469A16CECD3588FDCB6573B034D96316CA0D3BA83611B
Submitted as: 03d2e8ef968a70c032ffb01c98b29ab612ae48043b44e63d15c2504f7f85de13.exe
File type: pe · Size: 32256 bytes
Verdict: malicious (100/100) · Family: Bladabindi

Source: MalwareBazaar · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

Detections (9 of 53 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Packed.Generic-9795615-0
Hash: abuse.ch ThreatFox: known-malicious-hash
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Backdoor:MSIL/Bladabindi
Emsisoft (Emergency Kit): IL:Trojan.Bladabindi.G
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
Trellix Stinger (McAfee): Trojan-FSBT!0F7489280997

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9795615-0 (rule Win.Packed.Generic-9795615-0) - engine signal, weight 0.90, confidence 0.95
Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:MSIL/Bladabindi (rule Backdoor:MSIL/Bladabindi) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged IL:Trojan.Bladabindi.G (rule IL:Trojan.Bladabindi.G) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 30 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
Extracted Njrat config (0 C2) - engine signal, weight 0.45, confidence 0.60
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

8419 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt

Embedded domains

fly88fat.uk.com
inference.location.live.net
oneclient.sfx.ms

Embedded IP addresses

23.40.52.85
20.184.175.23
20.42.179.204
13.89.179.15
150.171.22.17
20.247.185.124
4.230.171.124
40.84.85.40
72.147.149.16
51.105.71.137
135.233.45.223
23.33.238.105
20.190.142.165
172.192.176.118
23.198.40.44
23.33.238.178
23.33.238.207
23.40.52.211
135.234.160.246
52.148.114.188
23.221.133.185
72.145.35.106
199.232.138.172
4.150.223.96
52.123.252.220

More Bladabindi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report