MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a28ec555b061aae946e75fc2e685a7cb012c2980ce78ab1ad09e18299f909793. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkCloud

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	a28ec555b061aae946e75fc2e685a7cb012c2980ce78ab1ad09e18299f909793
SHA3-384 hash:	17dd0368d1afa3766722aa2bc76d29d7ec5c7803155aa433695dd0162d33a39431df7866e534bc5d083f2fb5bf00ca17
SHA1 hash:	104cd9dbdb609a55b10cda9844ac98c1a01fc908
MD5 hash:	58bbb99873ee5eddf7c47f15a3835ad0
humanhash:	cup-diet-march-lactose
File name:	Solicitud de cotizaci�n.uu
Download:	download sample
Signature	DarkCloud Create hunting rule
File size:	611'855 bytes
First seen:	2025-07-21 18:43:37 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:Mmf4tNIFHhSI6UFnKn688l24hXrq0RIKJkvOHe+cKy7Rx9QiKNfJUe:94tClhSI5HzlxZ9uvOHe+S7Rx9GbUe
TLSH	T1FCD423E068D2905C08C656BDDE9A4CDFFB62C44FF90AD5B63A629C1563C0AC0169CADF
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	rar uu

cocaman

Malicious email (T1566.001)
From: "=?UTF-8?B?Q2l0cnVsc2EgZGUgTcOpeGljbywgUy5BLiBkZSBDLlYu?= <tuopinion@elsoldemexico.com.mx>" (likely spoofed)
Received: "from elsoldemexico.com.mx (unknown [172.245.93.67]) "
Date: "21 Jul 2025 20:42:34 +0200"
Subject: "Orden de compra adjunta"
Attachment: "Solicitud de cotizaci�n.uu"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=687e8a8a2f623871a5f16b86

Tags:

virus

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed similar-threat

Link:

https://www.filescan.io/uploads/687e8a8b7bc45bdee1b3af71/reports/c4c064f8-23d6-4de5-ab49-f377b9c14a47/overview

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Executable PE (Portable Executable) Rar Archive

Link:

https://app.malva.re/file/58bbb99873ee5eddf7c47f15a3835ad0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a28ec555b061aae946e75fc2e685a7cb012c2980ce78ab1ad09e18299f909793/

Threat name:

Win32.Trojan.DarkCloudStealer

Status:

Malicious

First seen:

2025-07-22 01:49:00 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ukhmkvnqmgvosrxhl7bonbnhzmasykmazz4kwgwqtymcth4qs6jq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a28ec555b061aae946e75fc2e685a7cb012c2980ce78ab1ad09e18299f909793

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)