🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ky9Agent


Vendor detections: 18


Intelligence 18 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2
SHA3-384 hash: 75c5569ebdb1420c98abbcfd82f1f4268ef58701b55b3808f153f62960f84b0758f442f27875e59b472b2ca95396e4ab
SHA1 hash: 9434603ec9f89a9bb108900e9c0b80a35cec8bb8
MD5 hash: b183e0d9284e8615f8581e03e5d063f3
humanhash: burger-carolina-nuts-solar
File name:d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2
Download: download sample
Signature Ky9Agent
Create hunting rule
File size:68'364 bytes
First seen:2026-11-12 13:57:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'361 x AgentTesla, 20'867 x Formbook, 12'418 x SnakeKeylogger)
ssdeep 1536:KE4AYpSk8yjsA+EeXYX7o3xHxSEZtx86kKo5nO:KvAtZtA+XYLo3xHxSEZyKoNO
TLSH T1E96301272FFCAFBCD579D33A5971A22145B48B816C22CE6E4CD5D8E452262A013C573F
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Threatray
Tags:exe Ky9Agent

Intelligence

File Origin
# of uploads :
1
# of downloads :
170
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
PostExploitTool
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ee3d6c53-ec1c-491d-bd67-078636ae854e/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-12 15:09:12 UTC
Tags:
smb auto-sch auto-reg auto-startup amsi-bypass
Link:
https://app.any.run/tasks/1017a85a-23f0-4e9a-a48d-32f879e5e0c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99603/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af5c5fbed14d027dfb567da
Tags:
injection autorun sage remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating synchronization primitives
Launching a process
Connection attempt
Sending a custom TCP request
Creating a process from a recently created file
Creating a file in the system32 subdirectories
Launching a service
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Creating a file in the mass storage device
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 obfuscated overlay packed
Link:
https://www.filescan.io/uploads/6af5c5fee8d36354ca568f19/reports/0abbbfb9-58ab-42a4-993e-e62d2017d153/overview
Verdict:
Malicious
Labled as:
MSIL.Krypt..Generic
Link:
https://www.hybrid-analysis.com/sample/d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-21T18:27:00Z UTC
Last seen:
2026-10-21T18:54:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a16144d0-0d0d-4d97-be74-4509834c34f0
Result
Threat name:
n/a
Detection:
malicious
Classification:
adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2004772
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Creates an autostart registry key pointing to binary in C:\Windows
Creates files in the system32 config directory
Drops PE files to the startup folder
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens network shares
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2004772 Sample: qrgivjI94J.exe Startdate: 12/11/2026 Architecture: WINDOWS Score: 100 74 Malicious sample detected (through community Yara rule) 2->74 76 Antivirus detection for dropped file 2->76 78 Antivirus / Scanner detection for submitted sample 2->78 80 7 other signatures 2->80 7 qrgivjI94J.exe 2 47 2->7         started        12 win9aa9ae.exe 2->12         started        14 svc_8b76492778fb.exe 2->14         started        16 winaf86b1.exe 2->16         started        process3 dnsIp4 68 192.168.2.100 unknown unknown 7->68 70 192.168.2.101 unknown unknown 7->70 72 98 other IPs or domains 7->72 52 \Device\Mup\192.168.2.4\...\winea32c1.exe, PE32 7->52 dropped 54 \Device\Mup\192.168.2.4\...\winea11b1.exe, PE32 7->54 dropped 56 \Device\Mup\192.168.2.4\...\winde4465.exe, PE32 7->56 dropped 64 36 other malicious files 7->64 dropped 82 Drops PE files to the startup folder 7->82 84 Uses schtasks.exe or at.exe to add and modify task schedules 7->84 86 Opens network shares 7->86 18 schtasks.exe 7->18         started        20 schtasks.exe 7->20         started        22 schtasks.exe 7->22         started        30 21 other processes 7->30 58 \Device\Mup\192.168.2.4\...\wined1611.exe, PE32 12->58 dropped 60 \Device\Mup\192.168.2.4\...\windf218b.exe, PE32 12->60 dropped 62 \Device\Mup\192.168.2.4\...\windbd620.exe, PE32 12->62 dropped 66 15 other malicious files 12->66 dropped 88 Connects to many different private IPs via SMB (likely to spread or exploit) 12->88 90 Connects to many different private IPs (likely to spread or exploit) 12->90 92 Creates files in the system32 config directory 12->92 94 Creates an autostart registry key pointing to binary in C:\Windows 12->94 24 schtasks.exe 12->24         started        26 schtasks.exe 12->26         started        28 schtasks.exe 12->28         started        32 9 other processes 12->32 96 Antivirus detection for dropped file 14->96 98 Multi AV Scanner detection for dropped file 14->98 file5 signatures6 process7 process8 34 conhost.exe 18->34         started        36 conhost.exe 20->36         started        38 conhost.exe 22->38         started        40 conhost.exe 24->40         started        42 conhost.exe 26->42         started        44 conhost.exe 28->44         started        46 conhost.exe 30->46         started        48 20 other processes 30->48 50 9 other processes 32->50
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.21 Win 32 Exe x86
Link:
https://app.malva.re/file/b183e0d9284e8615f8581e03e5d063f3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2/
Threat name:
ByteCode-MSIL.Hacktool.AMSITamper
Create hunting rule
Status:
Malicious
First seen:
2026-10-22 01:31:30 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
24 of 36 (66.67%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3hf3qathvfjcqxvtbvwfj2g7zyj443h7ddfz3ifygiad6i7rjpra._file
Verdict:
malicious
Label(s):
Ky9Agent
Create hunting rule
Link:
https://reports.threatray.com/e56393cc-a8e3-4afa-9495-df8636a7c7f4
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution persistence privilege_escalation
Link:
https://tria.ge/reports/261112-raf69sgy31/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Drops file in System32 directory
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Contains code to disable Windows Defender
Malware Family:
n/a
Verdict:
Malicious
Tags:
rat sandbox_escape evasion
YARA:
Sandboxie_Detection BlacklistSandbox INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL sandboxdetect_misc Check_Dlls
Link:
https://app.threat.zone/submission/e38fff7d-6215-4b4c-9f1c-6d46e8234a08
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
dotnet exe polymorphic file-overlay debug-check
Link:
https://intel.virussign.com/intelligence/file/d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2
Unpacked files
SH256 hash:
d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2
MD5 hash:
b183e0d9284e8615f8581e03e5d063f3
SHA1 hash:
9434603ec9f89a9bb108900e9c0b80a35cec8bb8
Detections:
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Link:
https://www.unpac.me/results/24fe782a-baf4-4e61-a006-c6af2577ba20/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Dlls
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:TH_Win_ETW_Bypass_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Windows ETW Bypass Detection Rule - 2025
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://x.com/ThreatrayLabs/status/2120871740024684884
Cape
Cape
https://www.capesandbox.com/analysis/99603/

Comments