MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09b33b95097f1fb29949b64664379e838731085c8630f1af9ea1a6f823c5241e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09b33b95097f1fb29949b64664379e838731085c8630f1af9ea1a6f823c5241e
SHA3-384 hash: e1eef4cfa3c4f2bf90938d0b7f8ce4f920eb7a989838b4389f97fc4f40fe48bbe752d473bf7ca71fccae5ccbd00bdc98
SHA1 hash: 6d7755a67e506d1a5973cda6b4d195140db589ce
MD5 hash: 5f893a87f4a4d8d6065d3f2ed08270eb
humanhash: south-jupiter-artist-rugby
File name:Request for Quotation.exe
Download: download sample
Signature DarkCloud
Create hunting rule
File size:1'521'664 bytes
First seen:2023-04-26 12:42:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:eo4YUK9JClyPVSh0fX0MHcDF47s15xVaEnctnkSbpW91JescQGI:V41KsyNShqXxT7aZctkd9HJ
Threatray 16 similar samples on MalwareBazaar
TLSH T101651271619FC6D0E04ECBF0647CBCB2137074E3A9E989390B36A984CE5BF145DD4A9A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
dhash icon e29c2c74d4d4d4aa (4 x AgentTesla, 3 x Loki, 2 x SnakeKeylogger)
Reporter Anonymous
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Request for Quotation.exe
Verdict:
Malicious activity
Analysis date:
2023-04-26 12:45:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/86914fe9-4b37-4323-93bf-ed7d72ff7e25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/385058/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64491c57f61aa38da9fbf85a/reports/e5b5adb6-c385-4332-8b11-7ecbcc3c9207/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/09b33b95097f1fb29949b64664379e838731085c8630f1af9ea1a6f823c5241e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/478ce5af-32a1-400b-bb0c-619392d4fbe7
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
rans.spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1221570
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates files inside the volume driver (system volume information)
Drops executable to a common third party application directory
Found malware configuration
Found potential ransomware demand text
Infects executable files (exe, dll, sys, html)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to download HTTP data from a sinkholed server
Tries to harvest and steal browser information (history, passwords, etc)
Writes or reads registry keys via WMI
Yara detected DarkCloud
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 854519 Sample: Request_for_Quotation.exe Startdate: 26/04/2023 Architecture: WINDOWS Score: 100 44 Tries to download HTTP data from a sinkholed server 2->44 46 Snort IDS alert for network traffic 2->46 48 Multi AV Scanner detection for domain / URL 2->48 50 12 other signatures 2->50 6 Request_for_Quotation.exe 3 2->6         started        10 FXSSVC.exe 14 4 2->10         started        12 perfhost.exe 2->12         started        14 16 other processes 2->14 process3 dnsIp4 30 C:\Users\...\Request_for_Quotation.exe.log, CSV 6->30 dropped 58 Writes or reads registry keys via WMI 6->58 17 Request_for_Quotation.exe 4 6->17         started        60 Antivirus detection for dropped file 10->60 62 Machine Learning detection for dropped file 10->62 38 saytjshyf.biz 173.231.184.124, 49729, 80 VOXEL-DOT-NETUS United States 14->38 40 xlfhhhm.biz 173.231.189.15, 49727, 80 VOXEL-DOT-NETUS United States 14->40 42 24 other IPs or domains 14->42 64 Creates files inside the volume driver (system volume information) 14->64 file5 signatures6 process7 dnsIp8 32 pywolwnvd.biz 173.231.184.122, 49697, 49698, 49736 VOXEL-DOT-NETUS United States 17->32 34 zlenh.biz 17->34 36 13 other IPs or domains 17->36 22 C:\Windows\System32\xbgmsvc.exe, PE32+ 17->22 dropped 24 C:\Windows\System32\wbengine.exe, PE32+ 17->24 dropped 26 C:\Windows\System32\wbem\WmiApSrv.exe, PE32+ 17->26 dropped 28 33 other malicious files 17->28 dropped 52 Tries to harvest and steal browser information (history, passwords, etc) 17->52 54 Drops executable to a common third party application directory 17->54 56 Infects executable files (exe, dll, sys, html) 17->56 file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09b33b95097f1fb29949b64664379e838731085c8630f1af9ea1a6f823c5241e/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-04-21 07:48:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
26 of 37 (70.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bgztxfijp4p3fgkjwzdgin46qodtccc4qyypdl46ugtpqi6feqpa._file
Verdict:
malicious
Similar samples:
283d5eea1f9fc34e351deacc25006fc1997566932fae44db4597c84f1f1f3a30
DarkCloud
35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097
DarkCloud
7aba21bd10b88275b4620021abc90e8d0e5f8f0316e8d8c0b883554afc18f8ae
DarkCloud
9c4d77de2d7d2630f8f8ebe6d39340b7312af224764b75c0d165e8fff3411bc4
DarkCloud
b1516cc28d0e6e3f77a8eadd2a7fda7daf746e0a7b27088e016519baf8de0338
DarkCloud
c495bd45af034ec70254209b2bd4d122110382921601efa2c1a9c9dcc83d8343
DarkCloud
e65641bdd1d31a37d1caa1cbf41d05fa9e7b0caf3c5b531ba66d32c0a3a94406
DarkCloud
e6b2f93e2124fa13a05e54b0f0f9327ccdcebc38ee774332c22f34bf60771cef
DarkCloud
f91550582e9e831cba0a8ee62a9a47b3f9a4f1f24e228353d6f5050bc1b52509
DarkCloud
+ 6 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud spyware stealer
Link:
https://tria.ge/reports/230426-pxw5wsbb9t/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
DarkCloud
Unpacked files
SH256 hash:
2b6bb9637f7134c2eccd8b4dc740d1445fac04710abc04f8823bce2b63042ac9
MD5 hash:
6fa615f675dd4a68b9a1d527effc5d80
SHA1 hash:
7901c4dad10c87456b8b06ec4bea3a50f822b934
Link:
https://www.unpac.me/results/6e9186ef-ed08-4846-85fb-03e8e0a5abb1/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/6e9186ef-ed08-4846-85fb-03e8e0a5abb1/
SH256 hash:
686d7a0f616c32c209dbc486d15fc72b99246a22a7063f31bef14cf3dbefc608
MD5 hash:
db1b60e5ba59ba71e3206ff672d10a01
SHA1 hash:
f605cd33fbf3159bc77452cbd78e7f8b4159e65b
Link:
https://www.unpac.me/results/6e9186ef-ed08-4846-85fb-03e8e0a5abb1/
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
Link:
https://www.unpac.me/results/6e9186ef-ed08-4846-85fb-03e8e0a5abb1/
SH256 hash:
5877d94e89870078b85dcc9902d5aeda3eb61ed37bc57ad29180a5ee8f932d03
MD5 hash:
fa4a09bc5179ff5ccec70ebe581badb5
SHA1 hash:
353bd439078898ef57095a131c250ade72324a56
Link:
https://www.unpac.me/results/6e9186ef-ed08-4846-85fb-03e8e0a5abb1/
SH256 hash:
51e9b813382cd853599dab2833b2f70a358b5f2a72e91a8b5395ad6c45b63135
MD5 hash:
e7fb72dcd0dd9b9aa2421168f6278f91
SHA1 hash:
30c95a8ea72ecfbd6be438659474074e6934912c
Link:
https://www.unpac.me/results/6e9186ef-ed08-4846-85fb-03e8e0a5abb1/
SH256 hash:
98abbfeab699e0612eeef1bc55d998a66ea0af56ab3e6b4eacc59fe0eed6e925
MD5 hash:
d377ebb00b1ed619b19c091622e95661
SHA1 hash:
049b4825a61324e83e01c1f12a9fc957504bea90
Link:
https://www.unpac.me/results/6e9186ef-ed08-4846-85fb-03e8e0a5abb1/
SH256 hash:
09b33b95097f1fb29949b64664379e838731085c8630f1af9ea1a6f823c5241e
MD5 hash:
5f893a87f4a4d8d6065d3f2ed08270eb
SHA1 hash:
6d7755a67e506d1a5973cda6b4d195140db589ce
Link:
https://www.unpac.me/results/6e9186ef-ed08-4846-85fb-03e8e0a5abb1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/09b33b95097f1fb29949b64664379e838731085c8630f1af9ea1a6f823c5241e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

Executable exe 09b33b95097f1fb29949b64664379e838731085c8630f1af9ea1a6f823c5241e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/385058/

Comments