MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09e709903ca18593a35752d706652afc7937c25b1d328cd7b805575d92f25b86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkCloud

Vendor detections: 8

Intelligence 8 IOCs YARA 8 File information Comments

SHA256 hash:	09e709903ca18593a35752d706652afc7937c25b1d328cd7b805575d92f25b86
SHA3-384 hash:	6e3b046520c4a4173f9b6260ae5b4d3cc05b9da35a99986a566cc82eac6d08ba6924374162fb2eb90bd7aa5d8a4f5756
SHA1 hash:	cdd768d2434cf6b52bf40b714480cac0d5d652db
MD5 hash:	5145e516d196f2e27eedaae84741b671
humanhash:	yankee-shade-oklahoma-artist
File name:	Request for quote.rar
Download:	download sample
Signature	DarkCloud Create hunting rule
File size:	1'280'620 bytes
First seen:	2025-08-27 06:52:06 UTC
Last seen:	2025-08-27 10:20:50 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:3QECqXs83skzqZZ7eo87RuuqDspjEOwX3Da8XnxV4CsEQzvSIPcLsHGsQjSpm:gzcNskzqZZ7eBNu8e5a83XzsEQjS7Lsi
TLSH	T14A5533FE40D403768F28814F1AEFCE597455F87F5A49BA6FC12AF581AB314BF2480A85
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	DarkCloud QUOTATION rar

cocaman

Malicious email (T1566.001)
From: "Gerencia De Planejamento <gplan@sefaz.pb.gov.br>" (likely spoofed)
Received: "from mail.receita.pb.gov.br (mail.receita.pb.gov.br [200.164.224.12]) "
Date: "Wed, 27 Aug 2025 01:49:57 -0300 (BRT)"
Subject: "Request for quotation"
Attachment: "Request for quote.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	Request for quote.scr
File size:	1'361'920 bytes
SHA256 hash:	102a8536a3b1ba08ac040c2a231ed67aaf22fdf12db43c7ba063a82a30e60030
MD5 hash:	e23fdec38ab0d34a276d9ff1e99d6e26
MIME type:	application/x-dosexec
Signature	DarkCloud

File name:	32512
File size:	20 bytes
SHA256 hash:	02767176df44d7340e1040b477fd4ce833882181f6167e07b220dcab0df00431
MD5 hash:	9f1ae804d3f7c9ed62f01a2d04854c4d
MIME type:	application/octet-stream
Signature	DarkCloud

Vendor Threat Intelligence

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ae9bc9eb163e0ec182d1be

Tags:

stration spawn shell

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 bitmap confuserex lolbin msbuild obfuscated packed packed reconnaissance regsvcs roboski schtasks stego vbc vbnet

Link:

https://www.filescan.io/uploads/68aeab3f4a87ed79676d71a1/reports/56d6bdb7-79e0-4ffb-bd5a-433ac7f96baa/overview

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/09e709903ca18593a35752d706652afc7937c25b1d328cd7b805575d92f25b86

Verdict:

Malicious

File Type:

rar

Link:

https://opentip.kaspersky.com/09e709903ca18593a35752d706652afc7937c25b1d328cd7b805575d92f25b86/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout Rar Archive SOS: 0.38

Link:

https://app.malva.re/file/5145e516d196f2e27eedaae84741b671

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/09e709903ca18593a35752d706652afc7937c25b1d328cd7b805575d92f25b86/

Threat name:

ByteCode-MSIL.Backdoor.FormBook

Status:

Malicious

First seen:

2025-08-27 06:52:10 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

25 of 38 (65.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bhtqteb4ugczhi2xkllqmzjk7r4tpqs3duzizv5yavlv3exsloda._file

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud defense_evasion discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/250827-k9953axxfz/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Modifies trusted root certificate store through registry

DarkCloud

Darkcloud family

Malware Config

C2 Extraction:

https://api.telegram.org/bot8255940048:AAE4byL4CCBuAdJlT_0J7mlvMfy6hJvqTIs/sendMessage?chat_id=8029948911

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/09e709903ca18593a35752d706652afc7937c25b1d328cd7b805575d92f25b86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)