🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ky9Agent


Vendor detections: 17


Intelligence 17 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54
SHA3-384 hash: bdd71daa9dde4324c24514d635d457142a0007e4a9d35ad60016d0310b46a0e18b8d0a77b18707522a15e590023fe526
SHA1 hash: eb9c09a80b9244f2b7cdfffc14e42a2836ec8641
MD5 hash: a06d1841a4fd9cfe180f48bf77255f6c
humanhash: king-arkansas-bravo-six
File name:48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54
Download: download sample
Signature Ky9Agent
Create hunting rule
File size:97'345 bytes
First seen:2026-11-12 13:59:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'361 x AgentTesla, 20'867 x Formbook, 12'418 x SnakeKeylogger)
ssdeep 1536:U+uGB/l7P18QShxNjieeLjtA3ghGuqGs9WxuN++E6wn4bTje+CjAnq3qnxnwsH/M:5uGB/J18HieeNbNq3WD+E7y/zCjACS2X
TLSH T1939301F895DC9924DDAF1B7C1DF0071C1BF2B3A3E649C6097C9A1DE90F252AC502166B
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Threatray
Tags:exe Ky9Agent

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-12 14:28:41 UTC
Tags:
smb auto-reg auto-startup auto-sch
Link:
https://app.any.run/tasks/b1a778a6-160b-4e04-af9a-8dc619d9648f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99625/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af5c682c48f25399eb55e8c
Tags:
autorun adapter ordin msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Creating a file in the %temp% directory
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Connection attempt
Sending a custom TCP request
Creating a process from a recently created file
Searching for synchronization primitives
Launching a process
Creating a file in the system32 subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a single autorun event
Creating a file in the mass storage device
Enabling autorun
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Adding exclusions to Windows Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 masquerade obfuscated overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6af5c680d78ba865d0cc461a/reports/3175bbed-1d97-4021-b59f-ba6fbef2812d/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54
Verdict:
Malicious
File Type:
exe x32
Link:
https://opentip.kaspersky.com/48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e800f35c-68bc-4c2b-9f16-fe29c948cd35
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2004750
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds extensions / path to Windows Defender exclusion list (Registry)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Creates files in the system32 config directory
Creates multiple autostart registry keys
Creates processes via WMI
Drops PE files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
May drop file containing decryption instructions (likely related to ransomware)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens network shares
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2004750 Sample: RlHeBHIRQj.exe Startdate: 12/11/2026 Architecture: WINDOWS Score: 100 88 Malicious sample detected (through community Yara rule) 2->88 90 Antivirus detection for dropped file 2->90 92 Antivirus / Scanner detection for submitted sample 2->92 94 6 other signatures 2->94 8 RlHeBHIRQj.exe 9 58 2->8         started        13 wine5615e.exe 2->13         started        15 svc_ca5a05367f83.exe 2->15         started        17 5 other processes 2->17 process3 dnsIp4 82 192.168.2.100 unknown unknown 8->82 84 192.168.2.101 unknown unknown 8->84 86 98 other IPs or domains 8->86 64 \Device\Mup\192.168.2.8\...\winff6130.exe, PE32 8->64 dropped 66 \Device\Mup\192.168.2.8\...\winfb6ddd.exe, PE32 8->66 dropped 68 \Device\Mup\192.168.2.8\...\wined76cc.exe, PE32 8->68 dropped 78 65 other malicious files 8->78 dropped 110 Creates an undocumented autostart registry key 8->110 112 May drop file containing decryption instructions (likely related to ransomware) 8->112 114 Found many strings related to Crypto-Wallets (likely being stolen) 8->114 134 3 other signatures 8->134 19 win8265c7.exe 8->19         started        23 RuntimeHost.exe 2 8->23         started        25 schtasks.exe 8->25         started        35 12 other processes 8->35 70 \Device\Mup\192.168.2.8\...\win8432d6.exe, PE32 13->70 dropped 80 3 other malicious files 13->80 dropped 116 Creates files in the system32 config directory 13->116 118 Creates multiple autostart registry keys 13->118 120 Creates an autostart registry key pointing to binary in C:\Windows 13->120 122 Adds extensions / path to Windows Defender exclusion list (Registry) 13->122 27 schtasks.exe 13->27         started        29 schtasks.exe 13->29         started        31 schtasks.exe 13->31         started        72 \Device\Mup\192.168.2.8\...\winfadd1e.exe, PE32 15->72 dropped 74 \Device\Mup\192.168.2.8\...\winbc116c.exe, PE32 15->74 dropped 124 Connects to many different private IPs via SMB (likely to spread or exploit) 15->124 126 Connects to many different private IPs (likely to spread or exploit) 15->126 128 Opens network shares 15->128 76 \Device\Mup\192.168.2.8\...\wine02c32.exe, PE32 17->76 dropped 130 Antivirus detection for dropped file 17->130 132 Multi AV Scanner detection for dropped file 17->132 33 schtasks.exe 17->33         started        37 2 other processes 17->37 file5 signatures6 process7 file8 62 \Device\Mup\192.168.2.8\...\win6c07a0.exe, PE32 19->62 dropped 96 Creates files in the system32 config directory 19->96 98 May drop file containing decryption instructions (likely related to ransomware) 19->98 100 Creates multiple autostart registry keys 19->100 102 Opens network shares 19->102 39 schtasks.exe 19->39         started        41 schtasks.exe 19->41         started        104 Antivirus detection for dropped file 23->104 106 Multi AV Scanner detection for dropped file 23->106 108 Creates processes via WMI 25->108 43 conhost.exe 25->43         started        46 conhost.exe 27->46         started        48 conhost.exe 29->48         started        50 conhost.exe 31->50         started        52 conhost.exe 33->52         started        54 11 other processes 35->54 56 2 other processes 37->56 signatures9 process10 signatures11 58 conhost.exe 39->58         started        60 conhost.exe 41->60         started        136 Creates processes via WMI 43->136 process12
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.27 Win 32 Exe x86
Link:
https://app.malva.re/file/a06d1841a4fd9cfe180f48bf77255f6c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54/
Threat name:
Win32.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2026-11-08 15:04:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jdfcsd5ynp67rjh6z6qkowbh4qbxupzhjokrbnncq3q7flo53nka._file
Verdict:
malicious
Label(s):
Ky9Agent
Create hunting rule
Link:
https://reports.threatray.com/0775a80f-42d9-455b-bf28-fcaaede9453a
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery execution persistence privilege_escalation trojan
Link:
https://tria.ge/reports/261112-rbkwvagy6x/
Behaviour
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Registers new Windows logon scripts automatically executed at logon.
Windows security bypass
Windows security modification
Adds policy Run key to start application
Contains code to disable Windows Defender
Malware Family:
n/a
Verdict:
Malicious
Tags:
loader rat sandbox_escape evasion
YARA:
sandboxdetect_misc BlacklistSandbox
Link:
https://app.threat.zone/submission/6e2dc2e1-c69d-4ed9-9975-d4b7d83af73d
Malware Family:
msilheracles
Create hunting rule
Malicious:
True
Tags:
exe file-overlay polymorphic dotnet persistence obfuscated debug-check
Link:
https://intel.virussign.com/intelligence/file/48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54
Unpacked files
SH256 hash:
48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54
MD5 hash:
a06d1841a4fd9cfe180f48bf77255f6c
SHA1 hash:
eb9c09a80b9244f2b7cdfffc14e42a2836ec8641
Link:
https://www.unpac.me/results/0876e218-80c0-468a-8267-d49924b4f2d7/
SH256 hash:
166256dc56f2ed4013cda7ef87c4cf402e3d6295f53328f1510e3acf8eff6d83
MD5 hash:
4ba8c1e48b7e4a1f3652bb064ce6517a
SHA1 hash:
5fc2bdc383cfeb14192633b8e12b7568f67baddd
Detections:
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_DisableWinDefender
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Link:
https://www.unpac.me/results/0876e218-80c0-468a-8267-d49924b4f2d7/
Parent samples :
48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54
6602a9646c6c0a2dfb2f12f917f1e1d358d3d7bbaa3a2bdd1152f92b5066cf8f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://x.com/ThreatrayLabs/status/2120871740024684884
Cape
Cape
https://www.capesandbox.com/analysis/99625/

Comments