MALICIOUS — 72029a4d4790784dd3029d13e73f57494dcb8f8187ca234b131e2b825bd84336.bin

MALICIOUS — 72029a4d4790784dd3029d13e73f57494dcb8f8187ca234b131e2b825bd84336.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100), attributed to the Agentb family. 3 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 72029a4d4790784dd3029d13e73f57494dcb8f8187ca234b131e2b825bd84336
SHA-1: f9a692dadf9cc72352b979b1ecb80eb09ddf941a
MD5: b3a6fee3307f1c26841fd5c603e2b013
imphash: 0a8fd9d39bd6688a0cd1b2ecd766dde5
ssdeep: 49152:Qws63ot8nGtlqbFVwASOOZCV38b9KlkflztltK5kUvNsIfhhQuOPF7tp5Bk3Rb0:rkCTEBkFfXUh23DrsK1mWyUye+Qw7
TLSH: T188669D5146532111E5F6E914FC108EECF4A3B06CA934599E9303DC1E92B8EBBF2F51A8
Submitted as: 72029a4d4790784dd3029d13e73f57494dcb8f8187ca234b131e2b825bd84336.bin
File type: pe · Size: 6408192 bytes
Verdict: malicious (85/100) · Family: Agentb

Source: MalShare · first seen 2026-08-10T10:04:35.356Z · SHA-256 verified

Detections (3 of 52 engines)

YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
Kaspersky (KVRT): Trojan.Win64.Agentb.lhzo
Emsisoft (Emergency Kit): Trojan.Generic.39939030

MITRE ATT&CK

Why this verdict

The malicious score of 85/100 is the fusion of 7 weighted signals:

Memory forensics: 5 finding(s), e.g. RWX/private injected region in rundll32.exe (pid 3116) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 59 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 5.3.1.9, 1.9.16.3, 1.101.3.4 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

3739 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://github.com/dot-asm
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

github.com

Embedded IP addresses

5.3.1.9
1.9.16.3
1.101.3.4
12.2.2.8
12.2.1.16
61.1.1.1
52.123.252.219
4.150.223.111
52.110.12.8
52.230.60.54
172.215.188.232
74.179.77.204
52.168.112.67
20.236.44.162
20.231.239.246
52.110.12.1
52.123.252.236
52.110.12.53
52.110.12.26
4.230.171.124
74.178.240.61
135.233.45.221
20.76.201.171
20.184.175.18
92.223.78.30

File paths

C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\p\res
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\include\internal/packet.h
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\crypto\ml_dsa\ml_dsa_vector.h
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\crypto\err\err_local.h
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\include\internal/ring_buf.h
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\providers\implementations\ciphers\cipher_aes_cts.inc
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\providers\implementations\ciphers\cipher_camellia_cts.inc
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\providers\implementations\include\prov/blake2_params.inc
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\providers\implementations\ciphers\cipher_aes_hw_aesni.inc
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\providers\implementations\ciphers\cipher_aes_cfb_hw_aesni.inc
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\engines\e_capi_err.c
C:\Users\user\.conan2\p\b\opens5b7dfc6f8b832\b\src\providers\implementations\macs\blake2_mac_impl.c

More Agentb samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report