🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 16


Intelligence 16 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a
SHA3-384 hash: 45efb90fee5eed748d925e95c5fb419539d814aefb5dccef81b5ae33ef31d6950889148513abe74d7f7ff5347886ff12
SHA1 hash: 462e478ad29bf342ed02680ba47f67f6ad136df9
MD5 hash: 9e792c5989a469c4ddd4352d747efd25
humanhash: maine-coffee-nevada-sodium
File name:0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a
Download: download sample
File size:244'587 bytes
First seen:2026-11-12 13:59:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 6eb4c4f4ede3c97797666dcb01af02fe (1 x njrat)
ssdeep 3072:JAVFIYRzHiXSRB/eM2zVhio6+qzc1aDhlnf7OU20ByWUu4AcoEoByLC6TYGHCG0J:O/fRDiXqB8Vso6ZVlOU20YWEAtsYGUp
TLSH T12634BF57B3E630E9E077853989654645F37378720B609BDF03A4836A2F236C19E3EB61
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Threatray
Tags:exe Ky9Agent

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-12 14:33:41 UTC
Tags:
smb auto-startup auto-reg auto-sch scan smbscan
Link:
https://app.any.run/tasks/51f85c13-5dfe-4be3-8637-92f36da7e543

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99624/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af5c67fed14d027dfb56852
Tags:
injection autorun adapter ordin
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Enabling the 'hidden' option for analyzed file
Adding an access-denied ACE
Creating a file in the %temp% directory
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Connection attempt
Sending a custom TCP request
Searching for synchronization primitives
Launching a process
Creating a file in the system32 subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a single autorun event
Creating a file in the mass storage device
Enabling autorun
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Adding exclusions to Windows Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm microsoft_visual_cc overlay packed
Link:
https://www.filescan.io/uploads/6af5c67c3ad5a880731d38bd/reports/7fa2a069-d571-441e-a824-47ff90064c3c/overview
Verdict:
Malicious
Labled as:
Yogi.Generic
Link:
https://www.hybrid-analysis.com/sample/0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a
Verdict:
Malicious
File Type:
exe x64
Link:
https://opentip.kaspersky.com/0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/84d5afd5-c510-4c13-911b-fb3e19da332f
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2004751
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds extensions / path to Windows Defender exclusion list (Registry)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to inject code into remote processes
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates files in the system32 config directory
Creates multiple autostart registry keys
Drops PE files to the startup folder
Found evasive API chain (may stop execution after checking mutex)
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
May drop file containing decryption instructions (likely related to ransomware)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens network shares
Opens the same file many times (likely Sandbox evasion)
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2004751 Sample: keE1FdYjwm.exe Startdate: 12/11/2026 Architecture: WINDOWS Score: 100 95 mr-b01.tm-azurefd.net 2->95 97 eip-terr-na.cdp1.digicert.com.akahost.net 2->97 99 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->99 107 Malicious sample detected (through community Yara rule) 2->107 109 Antivirus detection for dropped file 2->109 111 Antivirus / Scanner detection for submitted sample 2->111 113 6 other signatures 2->113 10 keE1FdYjwm.exe 1 1 2->10         started        14 winee03f3.exe 2->14         started        16 win5131dd.exe 2->16         started        18 4 other processes 2->18 signatures3 process4 file5 81 C:\Users\user\AppData\...\rk006d754d.exe, PE32 10->81 dropped 133 Found evasive API chain (may stop execution after checking mutex) 10->133 135 Contains functionality to inject code into remote processes 10->135 137 Opens the same file many times (likely Sandbox evasion) 10->137 139 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 10->139 20 rk006d754d.exe 10->20         started        83 \Device\Mup\192.168.2.9\...\wina91d60.exe, PE32 14->83 dropped 85 C:\Windows\System32\...\svc_6c7b80349ea8.exe, PE32 14->85 dropped 87 C:\Windows\System32\...\RuntimeHost.exe, PE32 14->87 dropped 89 C:\ProgramData\...\svc_6c7b80349ea8.exe, PE32 14->89 dropped 141 Multi AV Scanner detection for dropped file 14->141 143 Creates an undocumented autostart registry key 14->143 145 Creates files in the system32 config directory 14->145 157 3 other signatures 14->157 25 schtasks.exe 14->25         started        27 schtasks.exe 14->27         started        29 schtasks.exe 14->29         started        31 sppsvc.exe 14->31         started        91 \Device\Mup\192.168.2.9\...\wine5a16f.exe, PE32 16->91 dropped 147 Connects to many different private IPs via SMB (likely to spread or exploit) 16->147 149 Connects to many different private IPs (likely to spread or exploit) 16->149 151 May drop file containing decryption instructions (likely related to ransomware) 16->151 93 \Device\Mup\192.168.2.9\...\win50f298.exe, PE32 18->93 dropped 153 Antivirus detection for dropped file 18->153 155 Opens network shares 18->155 33 schtasks.exe 18->33         started        35 schtasks.exe 18->35         started        37 schtasks.exe 18->37         started        signatures6 process7 dnsIp8 101 192.168.2.100 unknown unknown 20->101 103 192.168.2.101 unknown unknown 20->103 105 98 other IPs or domains 20->105 71 \Device\Mup\192.168.2.9\...\winfe4eac.exe, PE32 20->71 dropped 73 \Device\Mup\192.168.2.9\...\winfdb604.exe, PE32 20->73 dropped 75 \Device\Mup\192.168.2.9\...\winf9bcee.exe, PE32 20->75 dropped 77 86 other malicious files 20->77 dropped 115 Antivirus detection for dropped file 20->115 117 Multi AV Scanner detection for dropped file 20->117 119 Creates an undocumented autostart registry key 20->119 121 5 other signatures 20->121 39 wina91d60.exe 20->39         started        43 RuntimeHost.exe 20->43         started        57 17 other processes 20->57 45 conhost.exe 25->45         started        47 conhost.exe 27->47         started        49 conhost.exe 29->49         started        51 conhost.exe 33->51         started        53 conhost.exe 35->53         started        55 conhost.exe 37->55         started        file9 signatures10 process11 file12 79 \Device\Mup\192.168.2.9\...\win7ad93a.exe, PE32 39->79 dropped 123 Multi AV Scanner detection for dropped file 39->123 125 Creates files in the system32 config directory 39->125 127 May drop file containing decryption instructions (likely related to ransomware) 39->127 59 schtasks.exe 39->59         started        129 Antivirus detection for dropped file 43->129 131 Opens network shares 57->131 61 conhost.exe 57->61         started        63 conhost.exe 57->63         started        65 conhost.exe 57->65         started        67 9 other processes 57->67 signatures13 process14 process15 69 conhost.exe 59->69         started       
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/9e792c5989a469c4ddd4352d747efd25
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a/
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-11-08 20:45:09 UTC
File Type:
PE+ (Exe)
AV detection:
14 of 24 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bonvfq7sb5qryd2amdeloqo35xvcjxh53pze6e4txhxp4my52mfa._file
Verdict:
malicious
Label(s):
Ky9Agent
Create hunting rule
Link:
https://reports.threatray.com/a342f122-c4d5-45ab-91e1-f5ad90e088ae
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution persistence privilege_escalation trojan
Link:
https://tria.ge/reports/261112-rbkk3sgy6w/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Registers new Windows logon scripts automatically executed at logon.
Windows security bypass
Windows security modification
Adds policy Run key to start application
Contains code to disable Windows Defender
Malware Family:
n/a
Verdict:
Suspicious
Tags:
sandbox_escape evasion
YARA:
Check_Debugger AutorunKey
Link:
https://app.threat.zone/submission/8fbe9e8f-2e88-4b14-a53a-6ff7b1251525
Malware Family:
disco
Create hunting rule
Malicious:
True
Tags:
exe 64bit file-overlay persistence wmi-activity obfuscated adapter-discovery exec-delay usb-check debug-check env-check
Link:
https://intel.virussign.com/intelligence/file/0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a
Unpacked files
SH256 hash:
0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a
MD5 hash:
9e792c5989a469c4ddd4352d747efd25
SHA1 hash:
462e478ad29bf342ed02680ba47f67f6ad136df9
Link:
https://www.unpac.me/results/fa7383a3-7857-46eb-8b0c-a663a3e254b3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0b9b52c3f20f611c0f4060c8b741dbedea24dcfddbf24f1393b9eefe331dd30a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Debugger
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://x.com/ThreatrayLabs/status/2120871740024684884
Cape
Cape
https://www.capesandbox.com/analysis/99624/

Comments