🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ky9Agent


Vendor detections: 18


Intelligence 18 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc
SHA3-384 hash: ed16da86ba01bf5396e319928c61cc60d8fd5e227cb3837a982bdb8088c779b17d2e3dce9e608aee080dee89e5b2d30d
SHA1 hash: 2480bdec6d29eab1a5fab5c658b922d1f333977f
MD5 hash: 3c9e499362f7784fd53a073e0eb0e248
humanhash: delaware-magnesium-single-timing
File name:ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc
Download: download sample
Signature Ky9Agent
Create hunting rule
File size:68'364 bytes
First seen:2026-11-12 13:57:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'361 x AgentTesla, 20'867 x Formbook, 12'418 x SnakeKeylogger)
ssdeep 1536:KE4AlWzLjyDRs+vzaxJy4Ob+zcRU2wrviT55X:KvAlILjyDve/5Ob+zYurg55X
TLSH T10B63F123BFE98FF5E4E9CFF979E343109A3496505922CD2D5E30286C19009FE42667B2
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Threatray
Tags:exe Ky9Agent

Intelligence

File Origin
# of uploads :
1
# of downloads :
175
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
PostExploitTool
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0f105e4b-0f7e-411f-8bc4-b9a8be963a8c/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-12 14:57:12 UTC
Tags:
smb auto-startup auto-reg auto-sch amsi-bypass
Link:
https://app.any.run/tasks/c46b3eaf-8004-419a-882d-3a1eba821854

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99604/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af5c5fded14d027dfb567e4
Tags:
injection autorun sage remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Enabling the 'hidden' option for recently created files
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating synchronization primitives
Launching a process
Connection attempt
Sending a custom TCP request
Creating a process from a recently created file
Creating a file in the system32 subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Creating a file in the mass storage device
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 obfuscated overlay packed
Link:
https://www.filescan.io/uploads/6af5c60081d4d5435e990a9c/reports/cbea3370-0ca9-41e4-8458-ca0c4c972769/overview
Verdict:
Malicious
Labled as:
MSIL.Krypt..Generic
Link:
https://www.hybrid-analysis.com/sample/ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-21T14:55:00Z UTC
Last seen:
2026-10-21T15:12:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9f8d6d7c-a827-4583-bd71-cce1fbd05572
Result
Threat name:
n/a
Detection:
malicious
Classification:
adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2004771
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Creates an autostart registry key pointing to binary in C:\Windows
Creates files in the system32 config directory
Drops PE files to the startup folder
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens network shares
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2004771 Sample: a8T1RyM2Ox.exe Startdate: 12/11/2026 Architecture: WINDOWS Score: 100 71 Malicious sample detected (through community Yara rule) 2->71 73 Antivirus detection for dropped file 2->73 75 Antivirus / Scanner detection for submitted sample 2->75 77 7 other signatures 2->77 7 a8T1RyM2Ox.exe 2 44 2->7         started        12 win4ec0df.exe 2->12         started        process3 dnsIp4 65 192.168.2.100 unknown unknown 7->65 67 192.168.2.101 unknown unknown 7->67 69 98 other IPs or domains 7->69 49 \Device\Mup\192.168.2.6\...\winff8e34.exe, PE32 7->49 dropped 51 \Device\Mup\192.168.2.6\...\winf7c6ab.exe, PE32 7->51 dropped 53 \Device\Mup\192.168.2.6\...\wind707ae.exe, PE32 7->53 dropped 61 33 other malicious files 7->61 dropped 79 Drops PE files to the startup folder 7->79 81 Uses schtasks.exe or at.exe to add and modify task schedules 7->81 83 Opens network shares 7->83 14 win32c2c1.exe 7->14         started        17 svc_561ab39524e8.exe 7->17         started        19 schtasks.exe 7->19         started        27 24 other processes 7->27 55 \Device\Mup\192.168.2.6\...\wine193c4.exe, PE32 12->55 dropped 57 \Device\Mup\192.168.2.6\...\wind960d8.exe, PE32 12->57 dropped 59 \Device\Mup\192.168.2.6\...\winc3d94d.exe, PE32 12->59 dropped 63 14 other malicious files 12->63 dropped 85 Antivirus detection for dropped file 12->85 87 Multi AV Scanner detection for dropped file 12->87 89 Connects to many different private IPs via SMB (likely to spread or exploit) 12->89 91 3 other signatures 12->91 21 schtasks.exe 12->21         started        23 schtasks.exe 12->23         started        25 schtasks.exe 12->25         started        29 8 other processes 12->29 file5 signatures6 process7 signatures8 93 Antivirus detection for dropped file 14->93 95 Multi AV Scanner detection for dropped file 14->95 97 Creates files in the system32 config directory 14->97 99 Opens network shares 14->99 31 conhost.exe 19->31         started        33 conhost.exe 21->33         started        35 conhost.exe 23->35         started        37 conhost.exe 25->37         started        39 conhost.exe 27->39         started        41 conhost.exe 27->41         started        43 conhost.exe 27->43         started        45 21 other processes 27->45 47 7 other processes 29->47 process9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.21 Win 32 Exe x86
Link:
https://app.malva.re/file/3c9e499362f7784fd53a073e0eb0e248
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc/
Threat name:
ByteCode-MSIL.Hacktool.AMSITamper
Create hunting rule
Status:
Malicious
First seen:
2026-10-21 20:01:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
26 of 36 (72.22%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=544yh2q3oaxmwygfwypfu3sc7prl5fd7gd4bxiutwkhd5r22kc6a._file
Verdict:
malicious
Label(s):
Ky9Agent
Create hunting rule
Link:
https://reports.threatray.com/516a221b-7a3f-44c2-93a3-05a2b6fb8f38
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution persistence privilege_escalation
Link:
https://tria.ge/reports/261112-raf69sgy4s/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Drops file in System32 directory
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Contains code to disable Windows Defender
Malware Family:
n/a
Verdict:
Malicious
Tags:
rat sandbox_escape evasion
YARA:
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL sandboxdetect_misc Sandboxie_Detection BlacklistSandbox Check_Dlls
Link:
https://app.threat.zone/submission/8c37cad7-35a8-46aa-94fe-787a424b29a4
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
file-overlay polymorphic exe dotnet persistence debug-check
Link:
https://intel.virussign.com/intelligence/file/ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc
Unpacked files
SH256 hash:
ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc
MD5 hash:
3c9e499362f7784fd53a073e0eb0e248
SHA1 hash:
2480bdec6d29eab1a5fab5c658b922d1f333977f
Detections:
INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Link:
https://www.unpac.me/results/1183973c-e0d5-4156-a2e1-43914b217277/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Dlls
Create hunting rule
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:TH_Win_ETW_Bypass_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Windows ETW Bypass Detection Rule - 2025
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://x.com/ThreatrayLabs/status/2120871740024684884
Cape
Cape
https://www.capesandbox.com/analysis/99604/

Comments