🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 15


Intelligence 15 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b
SHA3-384 hash: f12595b1a4273a301bc762cd163309443fcb4b171289c1b04445f139f287c4ec01fc0725d2354b6348717d4829de9758
SHA1 hash: 9497c853f88d3ead7f13d77daf7e4a4c7017cc0b
MD5 hash: 257d3e9adfe7a273a3da02c646d8e5ec
humanhash: chicken-lithium-skylark-mockingbird
File name:eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b.bin
Download: download sample
File size:3'863'040 bytes
First seen:2026-11-10 11:55:37 UTC
Last seen:2026-11-10 12:49:09 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 66afe721519775c5758f507fe819c87a
ssdeep 49152:2bKxE/Vd51th0aPnSW5JSyhEVjGj4nZ7qr424y8NpFsfZml98BMmJBXrHfkpBtKL:2PjdStywG42H8jFUZs98zJlHMpBAOvB
TLSH T130060226E7E511E9E0B3D679CA276513F7B27806433097DB43D05A4A0F36BE48A3EB11
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter kernelv0id
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
117
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-10 16:21:05 UTC
Tags:
uac cryptbot stealer
Link:
https://app.any.run/tasks/33d67e6a-242c-4387-9290-57c4fbf0cde5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99061/
Detection(s):
ditekSHen.MALWARE.Win.Trojan.StrongPity.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af3066638dc20c444c383aa
Tags:
strongpity shellcode dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Creating synchronization primitives
Creating a file in the %temp% directory
Launching a process
Searching for synchronization primitives
Changing a file
Searching for the window
Creating a process with a hidden window
Reading critical registry keys
Moving a recently created file
Deleting a recently created file
Replacing files
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 cmd crypto evasive fingerprint hacktool keylogger lolbin masquerade microsoft_visual_cc reconnaissance schtasks wscript
Link:
https://www.filescan.io/uploads/6af30668769a94ac921bb085/reports/a7da567e-dfca-48a0-abbe-4a7a4e9c5f8e/overview
Verdict:
Malicious
Labled as:
Capa_check_for_OutputDebugString_error
Link:
https://www.hybrid-analysis.com/sample/eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-10T01:19:00Z UTC
Last seen:
2026-10-10T01:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6f8300b9-acc2-4413-9e62-afe392e0b071
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/2003118
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking mutex)
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2003118 Sample: NAgNV3Y9ab.exe Startdate: 10/11/2026 Architecture: WINDOWS Score: 96 103 p4l.duckdns.org 2->103 105 fg.microsoft.map.fastly.net 2->105 119 Malicious sample detected (through community Yara rule) 2->119 121 Antivirus / Scanner detection for submitted sample 2->121 123 Multi AV Scanner detection for submitted file 2->123 127 5 other signatures 2->127 11 NAgNV3Y9ab.exe 1 7 2->11         started        16 msedge.exe 26 571 2->16         started        18 SecurityHealthSystray.exe 2->18         started        20 SecurityHealthSystray.exe 2->20         started        signatures3 125 Uses dynamic DNS services 103->125 process4 dnsIp5 107 p4l.duckdns.org 154.250.205.45, 5000 ALGTEL-ASDZ Algeria 11->107 95 C:\Users\user\...\OfficeClickToRun.exe, PE32+ 11->95 dropped 97 C:\...\OfficeClickToRun.exe:Zone.Identifier, ASCII 11->97 dropped 99 C:\Users\user\AppData\Local\...\F90B5B97.dll, PE32+ 11->99 dropped 101 C:\Users\user\AppData\Local\...\96E941B7.dll, PE32+ 11->101 dropped 139 Found evasive API chain (may stop execution after checking mutex) 11->139 141 Found many strings related to Crypto-Wallets (likely being stolen) 11->141 143 Writes to foreign memory regions 11->143 145 3 other signatures 11->145 22 OfficeClickToRun.exe 11->22         started        26 msedge.exe 9 11->26         started        28 chrome.exe 11->28         started        109 192.168.2.7, 138, 443, 49707 unknown unknown 16->109 111 239.255.255.250 unknown ZZ 16->111 30 msedge.exe 16->30         started        33 msedge.exe 16->33         started        35 msedge.exe 16->35         started        37 msedge.exe 16->37         started        file6 signatures7 process8 dnsIp9 93 C:\Users\user\...\SecurityHealthSystray.exe, PE32+ 22->93 dropped 131 Multi AV Scanner detection for dropped file 22->131 39 SecurityHealthSystray.exe 22->39         started        42 cmd.exe 22->42         started        44 cmd.exe 22->44         started        50 2 other processes 22->50 46 msedge.exe 26->46         started        48 chrome.exe 28->48         started        113 mr-b01.tm-azurefd.net 150.171.109.147, 443, 49751 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 30->113 115 mr-z01.tm-azurefd.net 150.171.109.148, 443, 49724, 49731 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 30->115 117 33 other IPs or domains 30->117 file10 signatures11 process12 signatures13 133 Multi AV Scanner detection for dropped file 39->133 52 OfficeClickToRun.exe 39->52         started        55 OfficeClickToRun.exe 39->55         started        57 OfficeClickToRun.exe 39->57         started        135 Uses schtasks.exe or at.exe to add and modify task schedules 42->135 137 Potential Privilege Escalation using Task Scheduler highest RunLevel 42->137 59 conhost.exe 42->59         started        61 sc.exe 42->61         started        65 2 other processes 42->65 63 sc.exe 44->63         started        67 3 other processes 44->67 69 5 other processes 50->69 process14 signatures15 129 Found direct / indirect Syscall (likely to bypass EDR) 52->129 71 Conhost.exe 52->71         started        73 cmd.exe 55->73         started        75 cmd.exe 57->75         started        77 Conhost.exe 63->77         started        process16 process17 79 conhost.exe 73->79         started        81 sc.exe 73->81         started        83 sc.exe 73->83         started        85 sc.exe 73->85         started        87 conhost.exe 75->87         started        89 sc.exe 75->89         started        91 sc.exe 75->91         started       
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/257d3e9adfe7a273a3da02c646d8e5ec
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b/
Threat name:
Win64.Trojan.AgentB
Create hunting rule
Status:
Malicious
First seen:
2026-10-10 05:03:15 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5lqlbf4brrfey56cb3bofqr4dzqnqxhcaw6aw7w5cycd6l2ytsfq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery persistence ransomware
Link:
https://tria.ge/reports/261110-n35hsasxht/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
outlook_office_path
Browser Information Discovery
Reads the TCP/IP host and domain name from the registry
System Time Discovery
Drops file in Windows directory
Accesses Microsoft Outlook profiles
Loads dropped DLL
Malware Family:
n/a
Verdict:
Malicious
Tags:
rat stealer
YARA:
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM ParentProcessEvasion Disable_Defender win_hook UNPROTECT_disable_process INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender DebuggerCheck__MemoryWorkingSet win_token Antivirus_strings
Link:
https://app.threat.zone/submission/7dd234eb-7cd0-43f3-86d1-0e5774073eb4
Malware Family:
agentb
Create hunting rule
Malicious:
True
Tags:
exe 64bit debug-check exec-delay persistence
Link:
https://intel.virussign.com/intelligence/file/eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b
Unpacked files
SH256 hash:
eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b
MD5 hash:
257d3e9adfe7a273a3da02c646d8e5ec
SHA1 hash:
9497c853f88d3ead7f13d77daf7e4a4c7017cc0b
Detections:
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM
Create hunting rule
Link:
https://www.unpac.me/results/52616178-b4bd-4fa2-9c01-4ab914ef7639/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/eae0b097818c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eae0b097818c4a4c77c20ec2e2c23c1e60d85ce205bc0b7edd16043f2f589c8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClearWater_Ransomware
Create hunting rule
Author:Arrbat
Description:Detects ClearWater ransomware using a mix of family-specific names, 7-Zip SFX metadata, and anti-recovery indicators
Rule name:data_manipulation
Create hunting rule
Author:Serhii Kocherhan
Description:Detects data manipulation routines including XOR encoding, Base64 references, and RC4 PRGA encryption
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding command execution via IExecuteCommand COM object
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SUSP_Script_PowerShell_Hidden_Launcher
Create hunting rule
Author:Marjoriefort
Description:Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:Veille fraicheur 2026-09-14 / cluster misses web
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99061/

Comments