MALICIOUS — 08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4.img

MALICIOUS — 08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4.img is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Agentb family. 6 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4
• SHA-1: 1861526acc42bde948c5f01649ba6b7c4bf3f07a
• MD5: c280b597dd2ada5c78d39bb6a2809632
• ssdeep: 98304:91HuUcIzAjbncF+4f+0UuIjOH7tUejyb+c3hKYd9:tczbc04GkISH5Bjs+cwY
• TLSH: T1296501D500173222C4F6DD5AA02C8AED8463F098A0329F9AD017991E56DD3BBFBF14B5
• Submitted as: 08666ddfc8c8b1a9901914a2c3b8388da30ff532e598c88169fc42ee2fe3c8d4.img
• File type: unknown · Size: 6121472 bytes
• Verdict: malicious (99/100) · Family: Agentb

Source: MalwareBazaar · first seen 2026-07-30T00:00:00.000Z · SHA-256 verified

Detections (6 of 51 engines)

• capa (capabilities): capability:execution/powershell
• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Iso_pdf.UNOFFICIAL
• YARA: delivr.to detections: DLV_LNK_PowerShell_Launcher
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Kaspersky (KVRT): HEUR:Trojan.Win32.Agentb.gen

MITRE ATT&CK

• T1059.001
• T1071.001

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Iso_pdf.UNOFFICIAL (rule Sanesecurity.Foxhole.Iso_pdf.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Agentb.gen (rule HEUR:Trojan.Win32.Agentb.gen) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• Embedded executable payload carved at offset 63488 - static signal, weight 0.40, confidence 0.70
• YARA: delivr.to detections flagged DLV_LNK_PowerShell_Launcher (rule DLV_LNK_PowerShell_Launcher) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.videolan.org/, https://win.crashes.videolan.org/reports - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Contacted 15 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

846 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• desktop-hsgcbep
• WORKGROUP
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• ff02::1:3
• 224.0.0.252
• 224.0.0.251
• ff02::fb
• 10.240.0.1
• 239.255.255.250
• 52.148.114.188 SG · Singapore · AS8075 Microsoft Corporation
• ff02::16
• 10.240.0.255
• 169.254.255.255
• 4.247.188.233 IN · Pune · AS8075 Microsoft Corporation
• 40.84.85.40 US · Boydton · AS8075 Microsoft Corporation

Dropped files

• tmp_tmp.oIApHi0DBS - 53b05fffde31c33a0986fe8c879b738a1de05e58196f8a5a6749118e38903373

Embedded URLs

• http://www.digicert.com/CPS0
• http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl05
• http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
• http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
• https://sectigo.com/CPS0
• http://www.videolan.org/
• https://win.crashes.videolan.org/reports

Embedded domains

• u.ga
• cacerts.digicert.com
• crl3.digicert.com
• www.digicert.com
• crl4.digicert.com
• crl.usertrust.com
• crl.sectigo.com
• crt.sectigo.com
• sectigo.com
• www.videolan.org
• win.crashes.videolan.org

Embedded IP addresses

• 52.148.114.188
• 4.247.188.233
• 40.84.85.40
• 4.150.223.107
• 52.123.252.239
• 20.42.179.192
• 85.210.196.11
• 142.250.195.174
• 52.168.117.175
• 72.153.5.141
• 57.154.63.210

File paths

• M:\`
• C:\Windows\System32\cmd.exe

More Agentb samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report