MALICIOUS — 0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c.bin

MALICIOUS — 0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Dacic family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c
SHA-1: 661e474ccf2a5b99dbd0574a6155243d95347673
MD5: f61c8497f17d00be8c4adbd3fc49c0cf
imphash: d6444139d1e9eb8b292aa5f68be95025
ssdeep: 12288:FzpKN+kRKfJyV9afBbiS8xwy2dYskqZa77qwjYKkJj6GmZU:FzpKNVKfKZxwFdYsk2a7WmYb6nZ
TLSH: T1CF4B3A9CCF1A5E4EC572CE07D04029CD91DDF6BAAB99108D5203E8BF9390DDB4826876
Submitted as: 0a97a720e22bd0ea1bb3f9534f552d05f3e12e04a03d3c72920469312dcdb18c.bin
File type: pe · Size: 471040 bytes
Verdict: malicious (98/100) · Family: Dacic

Source: MalShare · first seen 2026-08-19T06:42:26.444Z · SHA-256 verified

Detections (6 of 55 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Malware.Dacic-10015827-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/DarkCloud.EALN!MTB
Emsisoft (Emergency Kit): Generic.Dacic.7D38A841.A.7E3AB034
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Dacic-10015827-0 (rule Win.Malware.Dacic-10015827-0) - engine signal, weight 0.90, confidence 0.95
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 16 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Extracted DarkCloud config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

42128 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787727578&P2=404&P3=2&P4=nxLccono6FttsCOFmOH4DvkKpVMPgra%2fiSpm7zJHgdGZsApaQYy7fFGeU08OUyfP%2bkJqgvnHMXhNV0z1zho0bw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787727661&P2=404&P3=2&P4=V2wRSj4EWsz66p33vKK0Q5fUiZX5BFz9jM%2btn1POt9NaGpBJCgEQB%2fV5STokdiMwUB%2b4A9U%2bsGbTBnwpbeFcaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

203.26.79.13
52.168.117.171
20.247.185.124
4.230.171.124
20.42.179.192
74.179.77.204
20.184.175.16
74.178.240.51
20.112.250.133
52.123.129.14
135.233.95.80
40.84.85.40
135.233.45.222
52.148.114.188
72.145.35.109
52.110.12.21

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\

File paths

C:\Program
C:\Users\Public\Libraries\vbsqlite3.dll
c:\vc5\
C:\Users\
C:\\MailMasterData\

More Dacic samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report