MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 21 File information Comments

SHA256 hash:	76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc
SHA3-384 hash:	00563d8faf065fd08b6be8ac3950b779e735fd6760413d28f920102f2ff74999c4a80ff604682747d6b9c064d4a4740f
SHA1 hash:	fb1ad7ab7b1ab8395f5765c194bf5ceb5b2d8f76
MD5 hash:	1ff47178321c36bc9dbb61e6d64cc13e
humanhash:	seventeen-orange-chicken-virginia
File name:	agent.exe
Download:	download sample
File size:	3'410'774 bytes
First seen:	2026-10-02 20:13:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	b02c2e7bc0614abea5e1eeec85591823
ssdeep	49152:6y5lkiva683HF19wBa9xOw7vWrO7UcYonNIlavg:3HuZSw7vJDYonNIlavg
TLSH	T1E1F5F85359DB0CA9CDD667BC61D75336A734FD368A291F3BA608C6312E136C4AD2EB00
TrID	45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 18.0% (.EXE) Win64 Executable (generic) (6522/11/2) 13.9% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.ICL) Windows Icons Library (generic) (2059/9) 5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	BlinkzSec

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-02 20:22:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/80b8d1c5-6007-4124-a4f6-b657de5300ca

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90364/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader50.28909.52235486.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6acf01de350c7ee8cc154cdc

Tags:

dropper shell sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Using the Windows Management Instrumentation requests

Creating a file

Creating a process from a recently created file

Creating a process with a hidden window

Connection attempt

Sending an HTTP POST request

Enabling autorun by creating a file

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Labled as:

Capa_check_for_OutputDebugString_error

Link:

https://www.hybrid-analysis.com/sample/76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-01T15:16:00Z UTC

Last seen:

2026-10-04T12:39:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3483d3fd-3724-460d-8d93-c20e3b012139

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

Executable Html PE (Portable Executable) PE File Layout SVG Win 64 Exe x64

Link:

https://app.malva.re/file/1ff47178321c36bc9dbb61e6d64cc13e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc/

Threat name:

Win64.Trojan.Agentagen

Status:

Malicious

First seen:

2026-10-01 21:16:13 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o3ivc3lnfpx7c7mmwhbuba5fiajtnu5artvcyowibmrdkabz2hga._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution persistence

Link:

https://tria.ge/reports/261002-yz3vwszhmc/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates connected drives

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Unpacked files

SH256 hash:

76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc

MD5 hash:

1ff47178321c36bc9dbb61e6d64cc13e

SHA1 hash:

fb1ad7ab7b1ab8395f5765c194bf5ceb5b2d8f76

Detections:

cn_utf8_windows_terminal

Link:

https://www.unpac.me/results/7c31d4fd-3663-4420-b7ad-80830acd7bd8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Base64_decoding Create hunting rule
Author:	iam-py-test
Description:	Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MULTI_Malware_RemcosRAT_ForgeAuto_4785f0c3 Create hunting rule
Author:	Marjoriefort
Description:	Detects RemcosRAT (inconnu, etat binaire)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (script_js, etat binaire)

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	SUSP_Scheduled_Tasks_Create_From_Susp_Dir Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

Rule name:	WIN_Malware_Havoc_ForgeAuto_99a4f65a Create hunting rule
Author:	Marjoriefort
Description:	Detects Havoc (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_37b4704b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_e596237b_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_ea6a0df5_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 76d1516d6d2beff17d8cb1c34083a5401336d3a08cea2c3ac80b22350039d1cc

(this sample)

Cape

https://www.capesandbox.com/analysis/90364/

URLhaus

https://urlhaus.abuse.ch/url/3927094/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample