MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b79720c1133b12a4ed824d20602fb14b0b736a1c0e60fe23c1b96d57ee031ba0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b79720c1133b12a4ed824d20602fb14b0b736a1c0e60fe23c1b96d57ee031ba0
SHA3-384 hash: b0998cdac6b94bf2e9105e37de4f6922fe6bef9c8158c3f8d36e8e71e25d3714883f7c9fbca6f4e8d03c8a711c199760
SHA1 hash: 4d04231811647ff1f5300e9c99882dc7084f5b13
MD5 hash: b1ac20a35e6a0546c932b3b83fe56853
humanhash: hotel-quiet-rugby-berlin
File name:Request for quotation.exe
Download: download sample
Signature DarkCloud
Create hunting rule
File size:1'550'848 bytes
First seen:2023-05-01 11:09:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:5XPUk+sHjI1AccWZV/7Ytz9WjFQPB/+V7yj3k/UjAM6AhYcbZNEH5mS:FPUk+knkYtzwFYBGV7D/nM68lbZq
Threatray 18 similar samples on MalwareBazaar
TLSH T11075BD3C49BCE23B91B8D6A58FE5842BF750D0AB3115AEE5ACD347658356E0234C723E
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Anonymous
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
238
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Request for quotation.exe
Verdict:
Malicious activity
Analysis date:
2023-05-01 11:11:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/44c33709-915f-4255-98ac-6a0265f47659

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/385806/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/644f9dcfd7f41b9c67315822/reports/d94195a1-bd86-4b30-aa95-469f333c186a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b79720c1133b12a4ed824d20602fb14b0b736a1c0e60fe23c1b96d57ee031ba0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/30ac925c-2e9e-4af0-93cd-300974f509d2
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1223973
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates files inside the volume driver (system volume information)
Drops executable to a common third party application directory
Found malware configuration
Infects executable files (exe, dll, sys, html)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries random domain names (often used to prevent blacklisting and sinkholes)
Snort IDS alert for network traffic
Tries to download HTTP data from a sinkholed server
Tries to harvest and steal browser information (history, passwords, etc)
Writes or reads registry keys via WMI
Yara detected DarkCloud
Yara detected Generic Dropper
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 856926 Sample: Request_for_quotation.exe Startdate: 01/05/2023 Architecture: WINDOWS Score: 100 33 vyome.biz 2->33 47 Tries to download HTTP data from a sinkholed server 2->47 49 Snort IDS alert for network traffic 2->49 51 Multi AV Scanner detection for domain / URL 2->51 53 11 other signatures 2->53 7 Request_for_quotation.exe 3 2->7         started        11 TieringEngineService.exe 2->11         started        13 armsvc.exe 1 2->13         started        16 16 other processes 2->16 signatures3 process4 dnsIp5 31 C:\Users\...\Request_for_quotation.exe.log, ASCII 7->31 dropped 61 Writes or reads registry keys via WMI 7->61 18 Request_for_quotation.exe 4 7->18         started        63 Creates files inside the volume driver (system volume information) 11->63 41 vrrazpdh.biz 107.6.74.76, 49746, 49758, 49774 VOXEL-DOT-NETUS United States 13->41 43 vyome.biz 162.217.98.146, 49771, 80 VOXEL-DOT-NETUS United States 13->43 45 42 other IPs or domains 13->45 file6 signatures7 process8 dnsIp9 35 dwrqljrr.biz 173.231.184.122, 49695, 49697, 49698 VOXEL-DOT-NETUS United States 18->35 37 cvgrf.biz 206.191.152.58, 49696, 49702, 80 VOXEL-DOT-NETUS United States 18->37 39 36 other IPs or domains 18->39 23 C:\Windows\System32\xbgmsvc.exe, PE32+ 18->23 dropped 25 C:\Windows\System32\wbengine.exe, PE32+ 18->25 dropped 27 C:\Windows\System32\wbem\WmiApSrv.exe, PE32+ 18->27 dropped 29 72 other malicious files 18->29 dropped 55 Tries to harvest and steal browser information (history, passwords, etc) 18->55 57 Drops executable to a common third party application directory 18->57 59 Infects executable files (exe, dll, sys, html) 18->59 file10 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b79720c1133b12a4ed824d20602fb14b0b736a1c0e60fe23c1b96d57ee031ba0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-04-27 06:48:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w6lsbqithmjkj3mcjuqgal5rjmfxg2q4bzqp4i6bxfwvp3qddoqa._file
Verdict:
malicious
Similar samples:
09b33b95097f1fb29949b64664379e838731085c8630f1af9ea1a6f823c5241e
DarkCloud
35ab280f808e981d3c77d1c4c38a8b84ac102cb6b08f11b6a632d11ccf7be097
DarkCloud
9c4d77de2d7d2630f8f8ebe6d39340b7312af224764b75c0d165e8fff3411bc4
DarkCloud
b1516cc28d0e6e3f77a8eadd2a7fda7daf746e0a7b27088e016519baf8de0338
DarkCloud
c495bd45af034ec70254209b2bd4d122110382921601efa2c1a9c9dcc83d8343
DarkCloud
e2c74cd730a858e1104119028b3d80e338900723485e5f8b6c02fd8eb459a998
DarkCloud
e65641bdd1d31a37d1caa1cbf41d05fa9e7b0caf3c5b531ba66d32c0a3a94406
DarkCloud
e6b2f93e2124fa13a05e54b0f0f9327ccdcebc38ee774332c22f34bf60771cef
DarkCloud
f91550582e9e831cba0a8ee62a9a47b3f9a4f1f24e228353d6f5050bc1b52509
DarkCloud
+ 8 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud spyware stealer
Link:
https://tria.ge/reports/230501-m84yrsfc48/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Executes dropped EXE
Reads user/profile data of web browsers
DarkCloud
Unpacked files
SH256 hash:
2b6bb9637f7134c2eccd8b4dc740d1445fac04710abc04f8823bce2b63042ac9
MD5 hash:
6fa615f675dd4a68b9a1d527effc5d80
SHA1 hash:
7901c4dad10c87456b8b06ec4bea3a50f822b934
Link:
https://www.unpac.me/results/33b21baa-8da0-4f29-aa38-64b0d213d1e6/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/33b21baa-8da0-4f29-aa38-64b0d213d1e6/
SH256 hash:
2f102c09f4b54feb8b3e7a747a23d96ffb9dda176c6b1910c8d33df967982803
MD5 hash:
ea6bf6473eb900733879372be46aadbe
SHA1 hash:
59dbf04412bae8124d82aaabac162ee2eba9f626
Link:
https://www.unpac.me/results/33b21baa-8da0-4f29-aa38-64b0d213d1e6/
SH256 hash:
58d2780bac07a53fa9ef0099c386ad23c2c5b83df99e18bbcca9895f829ef5d8
MD5 hash:
3a6ac846fbf56df68c3cb61cd18c7623
SHA1 hash:
e5b7f4e47b357f330b33330663ff5739a02d442f
Link:
https://www.unpac.me/results/33b21baa-8da0-4f29-aa38-64b0d213d1e6/
SH256 hash:
40c050c20d957d26b932faf690f9c2933a194aa6607220103ec798f46ac03403
MD5 hash:
c768bac25fc6f0551a11310e7caba8d5
SHA1 hash:
95f9195e959fb48277c95d1dd1c97a4edff7cb3a
Link:
https://www.unpac.me/results/33b21baa-8da0-4f29-aa38-64b0d213d1e6/
SH256 hash:
918e3039ae36b8baed5becfbfcbfc38c03dd407a52e3c803bba06ef7377b54ff
MD5 hash:
8c709e9ee0eae1ba71526bccac80d3f6
SHA1 hash:
90e63e9523ed950bcc8c3c361efcce518052fb9b
Link:
https://www.unpac.me/results/33b21baa-8da0-4f29-aa38-64b0d213d1e6/
SH256 hash:
d77047985d4948462e9013f1e5f2ee7cd60e1c0fdff74adb2b836a47c6046636
MD5 hash:
240352e0ab98f8b790968afe89a7a62d
SHA1 hash:
81c54e6d6d929837c9967757d05722c3435e0f81
Link:
https://www.unpac.me/results/33b21baa-8da0-4f29-aa38-64b0d213d1e6/
SH256 hash:
b79720c1133b12a4ed824d20602fb14b0b736a1c0e60fe23c1b96d57ee031ba0
MD5 hash:
b1ac20a35e6a0546c932b3b83fe56853
SHA1 hash:
4d04231811647ff1f5300e9c99882dc7084f5b13
Link:
https://www.unpac.me/results/33b21baa-8da0-4f29-aa38-64b0d213d1e6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Expiro
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b79720c1133b12a4ed824d20602fb14b0b736a1c0e60fe23c1b96d57ee031ba0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

Executable exe b79720c1133b12a4ed824d20602fb14b0b736a1c0e60fe23c1b96d57ee031ba0

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/385806/

Comments