MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f
SHA3-384 hash:	085ed1d5420f459d4e23273ac049b9930b965b8007ddf8c8113c3ce66f150761769746f5a02cc1afe0f05c11ed1f8f70
SHA1 hash:	320fe626856a4f518bdbd9412bb49cf5f4dc42fa
MD5 hash:	1abe8eee23d5fddb7ecc26f7f1865ff5
humanhash:	magazine-charlie-uniform-island
File name:	SecuriteInfo.com.Generic.Dacic.6942.B58750A0.14686.2810
Download:	download sample
File size:	61'952 bytes
First seen:	2026-01-24 09:34:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	804f215ec136a2d8766a73e605481db0
ssdeep	768:9H7A0eJ7PiNDrMyvSoAe0hsetRRxUYUlEV106Xapuva1bckmiLC2v7KJhiu:Z7A0aTkDo9d7ncblEVjaEvaOiLtW
TLSH	T16E531C0B734364EDD61BD5B445EFAB33BA72B8624630AF2F12E4DB701E14E501F6A918
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10522/11/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 e157ced84c0fa469f055004982ed81c48b2bfa72a8761b1e0290553c7a2b8c7c

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	29'696 bytes
File size (de-compressed) :	61'952 bytes
Format:	win64/pe
Packed file:	e157ced84c0fa469f055004982ed81c48b2bfa72a8761b1e0290553c7a2b8c7c

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Generic.Dacic.6942.B58750A0.14686.2810

Verdict:

Malicious activity

Analysis date:

2026-01-24 09:37:20 UTC

Tags:

barys auto-startup

Link:

https://app.any.run/tasks/7c563d4a-960c-4181-a93f-aa680d914689

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/49951/

Detection(s):

Win.Malware.Malwarex-10058597-0

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6974926cbcad3327ec083030

Tags:

backdoor autorun botnet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug crypto packed

Link:

https://www.filescan.io/uploads/69749258abc6d3ca6dec7a1c/reports/aee9b67a-d4bf-4222-b6ef-c0233ae235b1/overview

Verdict:

Malicious

Labled as:

Dacic.6942.Generic

Link:

https://www.hybrid-analysis.com/sample/0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-01-24T06:35:00Z UTC

Last seen:

2026-01-24T08:41:00Z UTC

Hits:

~10

Detections:

PDM:Trojan.Win32.Generic Trojan.Win32.Scar.uolc RemoteAdmin.LiteManager.TCP.C&C

Link:

https://opentip.kaspersky.com/0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/81e1150f-7b18-46dd-a3ff-6a14b8e5b5ee

Result

Threat name:

DDOS Bot

Detection:

malicious

Classification:

troj.adwa.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1856730

Signature

Contains functionality to detect sleep reduction / modifications

Drops PE files to the startup folder

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DDOS Bot

Behaviour

Behavior Graph:

Download SVG

Score:

94%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/1abe8eee23d5fddb7ecc26f7f1865ff5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f/

Verdict:

Malicious

Threat:

RemoteAdmin.LiteManager.TCP

Link:

https://tip.neiki.dev/file/0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f

Threat name:

Win64.Trojan.Dacic

Status:

Malicious

First seen:

2026-01-24 09:35:47 UTC

File Type:

PE+ (Exe)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bxdpl6fwbfzxkegbcyiris67ong4p5dpxlqmo2yfbax7fvg4uapq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/260124-lm3m5sbx4f/

Behaviour

Drops startup file

Unpacked files

SH256 hash:

0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f

MD5 hash:

1abe8eee23d5fddb7ecc26f7f1865ff5

SHA1 hash:

320fe626856a4f518bdbd9412bb49cf5f4dc42fa

Link:

https://www.unpac.me/results/39de7a31-fd20-42bf-a368-12f6c753b7b0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0dc6f5f8b609737510c11611144bdf734dc7f46fbae0c76b05082ff2d4dca01f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.