MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkCloud


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
SHA3-384 hash: e848ed5c9892269cf48a3865885dea1bb655b0095ae2cc38436cd3b4e034b3d9caf4bdcaf207b56ae50ab0a82d9d00d8
SHA1 hash: c4aab9c5dcd0f9e46071294846e16656dfa7d44e
MD5 hash: 460b17adb605a4b2312761a3543e28d1
humanhash: missouri-paris-kilo-kitten
File name:QUOTATION-V042_IV-08112025.exe
Download: download sample
Signature DarkCloud
Create hunting rule
File size:1'037'312 bytes
First seen:2025-08-11 06:19:16 UTC
Last seen:2025-08-14 11:06:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:edFdAquYYzNvWPfeEyL+OiMdNdI5PwPs7Up4ERMwvHrDh/ExI+Kz:DYYzN+XV8+avdIx0s7kDvvHrDhyI+K
TLSH T1E42522153216CC23D16603B84971C3B013B55CCEFA64C7EB9FDA7DABB4B1B019512AA7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 851a98b4909864c4 (58 x AgentTesla, 43 x Formbook, 34 x RedLineStealer)
Reporter adrian__luca
Tags:DarkCloud exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
42
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
QUOTATION-V042_IV-08112025.exe
Verdict:
Malicious activity
Analysis date:
2025-08-11 06:24:28 UTC
Tags:
stealer netreactor darkcloud upx evasion
Link:
https://app.any.run/tasks/c88ca7f9-5b91-435a-82c7-ac27402733c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20042/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68998bc1fca70bd90e8dfcee
Tags:
micro small hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Reading critical registry keys
DNS request
Connection attempt
Sending an HTTP GET request
Stealing user critical data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b898bdcf-9dd9-4ff0-89e7-2f3bddb5558d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14/
Verdict:
Malicious
Threat:
Family.DARKCLOUD
Link:
https://tip.neiki.dev/file/bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
Threat name:
Win32.Trojan.DarkCloudStealer
Create hunting rule
Status:
Malicious
First seen:
2025-08-11 00:15:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5iivarrwrp3hynurjfrshd7iipdikelq4ncysisuwt3hl2afmka._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
darkcloudstealer
Create hunting rule
Similar samples:
error
DarkCloud
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery spyware stealer
Link:
https://tria.ge/reports/250811-g47k7sgl5s/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
DarkCloud
Darkcloud family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5383a3e3-2967-4906-bd2a-8b438085980d
Unpacked files
SH256 hash:
abeaed5e6a4af91a608530139edefddb7177bc765d466a9e5708f92b69d6fa60
MD5 hash:
9c1a4c52dedcac64db2e1b67c253f5a7
SHA1 hash:
fb71c4901ba6626fa7f7c296ce2c3e7db6b67683
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
Parent samples :
1a9fc74a62360452410deb7b3949e3e1b85a31e2bab04799c3a915cc44762495
bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
SH256 hash:
c19873f8dc004d27a25a6cd16c0871afcc3a24af52f1a52138099431686efd5b
MD5 hash:
660162745f7d59549c682b1da7b5dfbd
SHA1 hash:
99b02bec93b05e3ed9b60e5fb7ce99aaa268e047
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab
MD5 hash:
073a17b6cfb1112c6c838b2fba06a657
SHA1 hash:
a54bb22489eaa8c52eb3e512aee522320530b0be
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
04ec771b7c29389eeb743893134abcf5e345bf36f594c0b1ee878d65a779d563
MD5 hash:
449d2a32a9b433e5dbda01cf5a0f34b8
SHA1 hash:
142301efe123ec70c0113e395079af037714b000
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
4d400c5e4319386acfec6f4532cfde9aa011a628a1e051c40059b1abd2cea83b
MD5 hash:
6951c279a6a5e3c5b032c07e021085ea
SHA1 hash:
1838f66b9a570ef1bce66d0a249e2d530f90cd6e
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
becfddbe22cf169085e383f783461c76567e45e5ef4d96c39577a2260221cff7
MD5 hash:
6dc07a350f1e1e2cd92886167c519ab1
SHA1 hash:
22e8573a0329d2ed44150e48689163558d098436
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
c026a8fdde4352e6873940aaf0f19e1a52db368b5e5a844dee1a04cedf2aa3c8
MD5 hash:
3bb94b4d2f837275b02b0cc55e68e729
SHA1 hash:
31367d2745fdecd78ddc50f7767b5ccba5156443
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
136a60c9c8c39591bd8dc97f1fb75cead5c9f8ed578ea0fee8a6732254dbd6d5
MD5 hash:
ff838709ab4f29234fdbe779e474fa2a
SHA1 hash:
80f5ae51201c00596589e050cdc445da93403991
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
Parent samples :
bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
6e1b5766415cd5d8e7f92d995828f0bca174fc5141af7e59e73f92e057df0626
c28647b50b1ac16ec5b52aee02a80b7d9f2be87ef63a9d070e52d1f775545ed3
329bd5c046cbf67eb31dd230e0d888374afbee19d89f333ffbe41494079dbdfd
cbf1ad5e6e1957e0015cec2ed9689a271df61b00e00e44684add564482531e73
06a4f5872145608425c3b41c01ee00f6b20986236d673ec5319184cc68a029e5
7832e657266ffed67b502312e3c3acafb5be68e0d9d96d849bdd6618ca7fc8c5
43d017af753a5790deabd17c4cd77bac6a6d33f7a889745319fcff7e32507756
c13bf83a2f54a7891da4885235434bafef3dd0a00ff221db0c897dc270d91e81
29e9068f2d5165e85d978531d9694ce538773cfdf65a9ee84aeaa688110ba877
4096e4527dcfadbbc23e3e845f87af5e07a2eb405caa53450944212118ee0cee
7c570b8b4d6d3a57d84b6a9b9f57860f542608346b2cf54d6f8d4e8f2710dc1a
373e2de5a86643443e0a31987c68a69a9c0c816b08becedc61d8a1a3aa6902c2
ea7b3b903fc3399683cd6e96898837f6c89cff99877af7d994e678bf6de6f52d
6d39efcc099850406049865919398ff1e38b06ee4841a9fba76bff863583f520
259a4ac57f8484acd58a5c354bf74d677a8676e27ba38222862c45f0e95aa323
22b3b9c3a34da4f16249ea7fd03526cad207e0535137f66c1c7596c43faadac0
9a94e891e348c3b34f1087fc5bd0f4d54f01f7ac6c6e58ae558d24e25013587b
004dcf9aaffaca3efa1f6e0019e9205f1344cbef12efd1ed8c17ec3a43ecaee0
885b1b681828760a1057f41aa4acf92d290caaf7d2a8c00c24325f6911ebec76
db7c69795df802060ba5ffc482dccfe9d35881974920462987573c6efb61abe0
d09bf8c52c9978e88635161a14002b3d1fd02615a782c3e3366c2d7f57dbf75e
e8de398ad0ec581f25871dded67f27a639515b89595f897fa00349f79af210a7
50c9089fe18238d44095d1f897507eab89baa65c85dabed3f099b73611492ec8
86a4c83d0629495fbfbbcd6df608209d5d873d18e2705dd6dcbca013774f3747
32d85ec69dd09f4808d33a117271e59e33b74febf82353d258e91745bb9980be
9ecc8f27bafbc29819f09ba664ffbcfede6f25afb3449d53d41ce9ecfc29641a
08761722c1c51fe2f880bad2c5a2ec108dcf5c398a3e2a2bdda3b16afd45d36d
4f7cc3de696e7c5e88e25625fe77f08c6472ff0581d4cc03c6c0c3204f7be784
edaba79c3d43a416a86003f336d879ed3a513aa24dd401340584615647ed6da2
6aefcac9b610a002e37fa3be97de13fdb2dda4b9d1ccda8434cd8994e46d297f
df4fdfeede419a20a887a34f436e146447d5eb9ad6febf38eed62a19a0f4f683
40e8a8796f4d79ba15a3b618c0bbd527db49674819b1e30791d2b704a684c756
927ee2efc981ff533b8af71f12802949bbe4b5d6032759dc15503338efb40047
0dae2a3a734163ec368a271822356004e53f8556ad654956dfd7570a49ba2b20
e30391464a63e304f33dc72ec39b2a19e6f722caa47157efa695945bef965953
5bbcc015fb254fe8bbe92dad15a7cf8bfad2aa1715487d535107fd91c4beb3c0
e83333296efc27158b82016eb794f5dcc6ad9d5bf5c1519dfc382bd549f8a472
f9c86d1815b169a952352073adc608b0e215e9bfb871cd85e59a76d1152aff14
4e7b57c893308666132aa151875d4d61c92975b9ce9adc062fe156d492a99ecb
26160f483487ec164d3b40e9ca5d1f6e5fef76d02d5530c22cd34374f8fd684f
7914b50d3cb4dfdbb2cc92b4b833d2e87416c39fb81f8979297a989f9b9c4bed
SH256 hash:
417620a5e30fbda3fd2d7a66214011f496d43de8a797cb198633c73ed86e1e6e
MD5 hash:
bc8610d2365f16162293325863ef4258
SHA1 hash:
85f8a533f5ed25c074355c4361124279f84dae67
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
4c4243bafcad1cccbc723b94ec3faeba9ee7e907789e0619ca51abecfebdcd5f
MD5 hash:
6335e5474115b34084929672332ce84e
SHA1 hash:
8873c8f97a0f318df9979f1527193aa071e4916e
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
2b67dfb7f12549e9162603f4324cfa5fe0c872765449e450512f92b7f3fc0493
MD5 hash:
4d38a863ada7bc4de9f2adc4c260d291
SHA1 hash:
a268da3de7b7132ca9fc774efb372de504ec08f7
Detections:
darkcloudstealer
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
Parent samples :
7b9545ff887d497969ef8b638bcdf57f9e1a86bb45b679f66e3532a2175fd8d7
4fb5ba01653be0268ec6b25fcfe0a87c21c233787a109d449d95ec31f6cdc090
8d20df4f97e4191d8628ea4cdd392ce13d819a024df3e9bf766b37901290486a
b00e6aecb2aeca732a68ba82d7e97af4a6e4ab01924c4be9a24b5e38634ff4a2
8f6803784f1c8fb38ed7f919882a5acb630f1e971d66f5fadf2261428ebddacb
1a9fc74a62360452410deb7b3949e3e1b85a31e2bab04799c3a915cc44762495
e8f21c243240c7e4a2c610d72900d48ada2beb65bd4e773a1b595c92213c4275
8fe222f2fa56b45a6464d5639963851a9a612ca5edb9ee1128e8e799992e9490
d3c5f814b53e20108aae779b1549f4ea7f0c3e148c6dcd2bd6f9b478c83dcd4d
bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
4d2cad76d403c73ae4be65d762e9cd9fa03b350a6e50479c643ffde4b7265c72
f914271a29baa3b1af4f9993012cf05411fb6f8bed29406b27f916d851dba323
41aff14f8e465462da99d979fec540eff4edd05a2791877c5d7d16411d9dd94d
f03262a7474474ccdae62c9aa1383a2d400ee6efb6a7213485fbd1f191342842
d30f6ed76c3227c5c41ace189733c322a846b780b1011683c7633c14ee480fc7
e65aaea1c0648796975c24a88a915e9f85cff51af0398a33bebcdaddf59d0440
5c15cd19a2df5d2b56e4f16a8ffaa0ea0573869e5191ec53d959b69c37239aa8
879f3434211bef680b1a4bef690b55b188bf93f0b6ce64368107f7dc9ae555ad
e5709b1a3c5da47bcda270f3feb2187b6f44add70d0d887b331004d634c03167
aa8573d46623ece59532f343f470aaa82a28cee22f00ed2b9b004db3a7810e05
5fe2cc4e418bd8819c9fc1aca0f97baccc83ce7f247d70c6cc902339adbd2b94
SH256 hash:
0c3015a7d74b442e58147d6314e04dbd7556c44fc1fe34a6c0c3456dc5e1a274
MD5 hash:
0ad8c0d92b70fcc5beaae2e1271abcea
SHA1 hash:
cec1066d39c0c69337f45d7ab10734515da79786
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
40a8f7034d1ef2f8143f9356dee17a4446e5a5d7ae911ea7ccaccb16fc361e01
MD5 hash:
a569007cbabb9e29eae96b7a39526b72
SHA1 hash:
e2b9112c87a25a13f8d8c37d63fa3a61a3186efa
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
76ef0f6400245aef55bada55e98f59dfbfb9f0c3a0251c94bd7699824b2d4fe1
MD5 hash:
ce34543fe55717c70bb2040ee1533e1f
SHA1 hash:
f9275e9ea193a651d9b7109d06bdb87e1fcf2965
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
Parent samples :
1a9fc74a62360452410deb7b3949e3e1b85a31e2bab04799c3a915cc44762495
bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
SH256 hash:
abca13e3d4c512a31b228bde07c408690e0680c584a520e39b975d7de3884f43
MD5 hash:
fe3a99c48c4df2542894b538892eb4f6
SHA1 hash:
30c35382c1d0b7eed9753d9c38ed5cb55e0cf375
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
SH256 hash:
bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14
MD5 hash:
460b17adb605a4b2312761a3543e28d1
SHA1 hash:
c4aab9c5dcd0f9e46071294846e16656dfa7d44e
Link:
https://www.unpac.me/results/0cf9cf34-8982-4b78-be9e-c6f81b8b2421/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bf508a8231b4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkCloud

Executable exe bf508a8231b45fb3e1b48a4b191c7f421e34288b871a2c4912a5a7b3af402b14

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/20042/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments