🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1
SHA3-384 hash: e77e0611862aede4c4b8c331684e1e83a01c230ce73a2b0b1e9a8ce47b69a67a8371448bd5cad8e5cb330ba5ff467a7f
SHA1 hash: 64d13d0fd7ce214d3ae1cf1bb79af7faf2ab0617
MD5 hash: 9f189d85af343d731d7e776ce025580d
humanhash: purple-juliet-nitrogen-cat
File name:0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1
Download: download sample
File size:5'438'464 bytes
First seen:2026-10-02 16:31:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 6ed4f5f04d62b18d96b26d6db7c18840 (1'121 x SalatStealer, 78 x BitRAT, 49 x Vidar)
ssdeep 98304:RdUz1OMePSzXZiRXb0HF3smbIb0eTW9m2r+nPFkHjhfqpcKIqDiqLcqzK71cp:wqZNDmbIoeTEBIPFBe1qLDKRc
TLSH T1594633DA914AB8BCDC56F4FF9AF609D45944376CA0235F4327E808848FAC19772B7463
TrID 63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12)
24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.ICL) Windows Icons Library (generic) (2059/9)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Anonymous
Tags:exe UPX
File size (compressed) :5'438'464 bytes
File size (de-compressed) :19'414'528 bytes
Format:win64/pe
Unpacked file: 3754689fafacd2ff1c50781de2027afb1a736f9dadf48767afe560fc0f10a6f0

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
EG EG
Vendor Threat Intelligence
Malware configuration found for:
PEPacker
Details
Link:
https://research.acce.ciphertechsolutions.com/results/42d14117-c3ca-450e-b638-63f316ea5eea/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-02 16:43:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/72373afd-2e4c-4766-9b97-2018998a3f09

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/90352/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acefb12350c7ee8cc154b5e
Tags:
virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed packed upx
Link:
https://www.filescan.io/uploads/6abfdc57cfb84bb631fa33af/reports/9dac4d7f-55d7-4c65-a21e-9b959a06b6ce/overview
Verdict:
Suspicious
Labled as:
Malware_
Link:
https://www.hybrid-analysis.com/sample/0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1
Verdict:
Unknown
File Type:
exe x64
First seen:
2026-10-01T17:52:00Z UTC
Last seen:
2026-10-04T13:56:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/edb128e5-ad83-41df-99fc-27c954a1e2a2
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/9f189d85af343d731d7e776ce025580d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1/
Threat name:
Win64.Trojan.Yogi
Create hunting rule
Status:
Malicious
First seen:
2026-10-01 21:54:26 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bxfmmbndudbxaakvenu2nj3qamrgwno55z3rbnku7tionae2o3iq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery upx
Link:
https://tria.ge/reports/261002-t1htwszt5n/
Behaviour
Suspicious use of AdjustPrivilegeToken
Reads the TCP/IP host and domain name from the registry
UPX packed file
Unpacked files
SH256 hash:
0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1
MD5 hash:
9f189d85af343d731d7e776ce025580d
SHA1 hash:
64d13d0fd7ce214d3ae1cf1bb79af7faf2ab0617
Detections:
SUSP_Imphash_Mar23_3
Create hunting rule
Link:
https://www.unpac.me/results/36fef439-bdf1-4c37-9810-27931b53a6b2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:UPX
Create hunting rule
Author:kevoreilly
Description:UPX Unpacker: dump on OEP (original entry point)
Rule name:upx_largefile
Create hunting rule
Author:k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Executable exe 0dcac605a3a0c37001552369a6a77003226b35ddee7710b554fcd0e6809a76d1

(this sample)

Executable exe 3754689fafacd2ff1c50781de2027afb1a736f9dadf48767afe560fc0f10a6f0

Cape
Cape
https://www.capesandbox.com/analysis/90352/
  
Dropping
SHA256 3754689fafacd2ff1c50781de2027afb1a736f9dadf48767afe560fc0f10a6f0
  
Dropping
MD5 74f7952ab77b5201d904e05a5ec0b498

Comments