MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c84f011369999892bf0674cb47482a2d85646870599c8174202a852895ec366e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c84f011369999892bf0674cb47482a2d85646870599c8174202a852895ec366e
SHA3-384 hash: f8ab46eb7708c424ec33f36a26d7266d28132cee6812560ce7e1c52511bd11e8191f4a6b2503a0c597164e140dac5af2
SHA1 hash: ffba46fba86945a5c96a3543bba147be39f0b9f2
MD5 hash: 1c8185449641d9dbe86afb3dc3d78511
humanhash: kansas-autumn-sixteen-massachusetts
File name:1c8185449641d9dbe86afb3dc3d78511.dll
Download: download sample
File size:26'839'040 bytes
First seen:2026-03-05 18:55:24 UTC
Last seen:2026-03-05 19:38:29 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dda65c5b8877d629e9188bba19e0c25e
ssdeep 393216:nIG6qcMK405dsuJTGHmVN+nO0NrN1IG6+ckj405dsOJTGHmVNwMnG0NrN:nlcMK40IsUO0lnlAkj40IMC8G0l
Threatray 501 similar samples on MalwareBazaar
TLSH T10B472310EBA05025F8F721F756FD956D992CBEF0276450CF42C566ED8A2A6E03E3231B
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
150
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/55742/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69a9d1d5002d37d5c9842977
Tags:
agentb virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug expired-cert fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/69a9d1cfc58f45aa751019e9/reports/dc1df5b9-731e-486c-998f-73d984125417/overview
Verdict:
Malicious
Labled as:
Gen_Variant_Application_Lazy_5827
Link:
https://www.hybrid-analysis.com/sample/c84f011369999892bf0674cb47482a2d85646870599c8174202a852895ec366e
Verdict:
Malicious
File Type:
dll x32
Detections:
Trojan.Win32.Agentb.tpyh Trojan.Win32.Agentb.sb
Link:
https://opentip.kaspersky.com/c84f011369999892bf0674cb47482a2d85646870599c8174202a852895ec366e/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1879185
Signature
Bypasses PowerShell execution policy
Encrypted powershell cmdline option found
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Tries to harvest and steal Bitcoin Wallet information
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1879185 Sample: sLqeLJY2LA.dll Startdate: 05/03/2026 Architecture: WINDOWS Score: 100 102 outlook.microsoft.l.lc 2->102 108 Suricata IDS alerts for network traffic 2->108 110 Multi AV Scanner detection for submitted file 2->110 112 Sigma detected: WScript or CScript Dropper 2->112 114 Joe Sandbox ML detected suspicious sample 2->114 12 loaddll32.exe 2 2->12         started        14 wscript.exe 2->14         started        17 svchost.exe 2->17         started        20 4 other processes 2->20 signatures3 process4 dnsIp5 22 rundll32.exe 3 12->22         started        25 cmd.exe 1 12->25         started        27 rundll32.exe 2 12->27         started        29 5 other processes 12->29 134 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->134 100 127.0.0.1 unknown unknown 17->100 signatures6 process7 signatures8 122 Bypasses PowerShell execution policy 22->122 31 powershell.exe 22->31         started        35 python.exe 38 22->35         started        124 Uses schtasks.exe or at.exe to add and modify task schedules 25->124 37 rundll32.exe 2 25->37         started        39 powershell.exe 27->39         started        41 python.exe 3 27->41         started        43 svchost.exe 27->43         started        process9 file10 82 C:\Users\user\AppData\Local\...\winsound.pyd, PE32 31->82 dropped 84 C:\Users\user\AppData\...\vcruntime140.dll, PE32 31->84 dropped 86 C:\Users\user\AppData\...\unicodedata.pyd, PE32 31->86 dropped 96 56 other files (55 malicious) 31->96 dropped 106 Loading BitLocker PowerShell Module 31->106 45 conhost.exe 31->45         started        88 C:\Users\user\AppData\Local\...\python.exe, PE32 35->88 dropped 90 C:\Users\user\AppData\Local\...\winsound.pyd, PE32 35->90 dropped 92 C:\Users\user\AppData\...\vcruntime140.dll, PE32 35->92 dropped 98 26 other files (none is malicious) 35->98 dropped 47 cmd.exe 1 35->47         started        49 conhost.exe 35->49         started        94 C:\Users\user\AppData\Local\...\macOSx.zip, Zip 37->94 dropped 51 powershell.exe 41 37->51         started        54 conhost.exe 39->54         started        56 conhost.exe 41->56         started        signatures11 process12 signatures13 58 python.exe 8 47->58         started        63 conhost.exe 47->63         started        116 Loading BitLocker PowerShell Module 51->116 118 Powershell drops PE file 51->118 65 conhost.exe 51->65         started        process14 dnsIp15 104 outlook.microsoft.l.lc 103.85.247.196, 49699, 56001 EIRTEL-AS-APEirtelServicesLtdBD unknown 58->104 76 C:\Users\user\AppData\...\tmp9tpubm4n.xml, XML 58->76 dropped 78 C:\Users\user\AppData\Local\Drivers\run.vbs, ASCII 58->78 dropped 80 C:\Users\user\AppData\Local\python.exe, PE32 58->80 dropped 126 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 58->126 128 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 58->128 130 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 58->130 132 4 other signatures 58->132 67 powershell.exe 58->67         started        70 cmd.exe 58->70         started        file16 signatures17 process18 signatures19 120 Loading BitLocker PowerShell Module 67->120 72 conhost.exe 67->72         started        74 schtasks.exe 70->74         started        process20
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c84f011369999892bf0674cb47482a2d85646870599c8174202a852895ec366e
Gathering data
Gathering data
Verdict:
Malicious
Threat:
Trojan.Win32.Agentb
Link:
https://tip.neiki.dev/file/c84f011369999892bf0674cb47482a2d85646870599c8174202a852895ec366e
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-03-03 06:19:15 UTC
File Type:
PE (Dll)
Extracted files:
2788
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zbhqce3jtgmjfpygotfuosbkfwcwi2dqlgoic5bafkcsrfpmgzxa._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
Similar samples:
0bf636489b239160bcd7a08ded2f7f8ba0fecf881828794d141223533a912c23
1a5a3ca3568d8f54e8e1516454ff0336d4ae4bc092e9439a67c7321b70cbd0fc
35f3ee553626b2267e4a8f35dce5b40840e5a461f13652bd2659681c31068805
5834d20cfc80f6fe20514b7a1e3e9764765aa3f548e2874504e9d26345f80560
901d6191e8bf99cf1a2a6b770519d18b82875294e95a55d1e87e42ef8bad213a
c84f011369999892bf0674cb47482a2d85646870599c8174202a852895ec366e
d593ddbfe63dbf2b738f9a64619fbb720fab9f79facdeedc24b2c6960121b1a4
e3a44cb80cdb955c23e48e1e3ab3d21dc3189b6a7617662c02bfa9635417841c
error
+ 491 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260305-xlfmrsaw4y/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/55742/

Comments