Request for Quotation.exe
Classification: Malicious
Request for Quotation.exe is a trojan (application/x-dosexec). Detected by 57 antivirus engines. Linked to Darkcomet, Uroburos malware.
Detection summary
- 57 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: DARKCOMET (S0334) UROBUROS (S0022)
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:39:40 | 2025-02-22 09:31:24 | G0010 Turla S0022 Uroburos | |
| DarkComet | MalwareBazaar Abuse.ch | 2023-05-19 12:33:13 | 2023-05-19 12:33:13 | malicious-activity | S0334 DarkComet |
Tags
win.snake ekans snakehoseSample information
- Filenames
- Request for Quotation.exe
- File type
- application/x-dosexec
- MD5
3a94a458ab6aa725826bb99bbb60f198- SHA-1
aa761d0d9095449da2cf01dc535f44ab4b32f03b- SHA-256
19ed2682196c62c35dfae288464bc621e251a6a3237216916479a8fcd06efa19- First indexed
- 2023-05-20 09:19:40
- Last updated
- 2026-10-07 23:48:45
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Gen:Variant.Ransom.Loki.2976 |
| APEX | Malicious |
| AVG | Win32:PWSX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.PWSX-gen.C5430214 |
| Alibaba | TrojanPSW:MSIL/Agensla.2f780927 |
| Arcabit | Trojan.Ransom.Loki.DBA0 |
| Avast | Win32:PWSX-gen [Trj] |
| Avira | HEUR/AGEN.1365403 |
| BitDefender | Gen:Variant.Ransom.Loki.2976 |
| Bkav | W32.AIDetectMalware.CS |
| CAT-QuickHeal | Trojan.GenericFC.S30222879 |
| CTX | exe.trojan.msil |
| ClamAV | Win.Packed.Formbook-10022571-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Siggen20.54727 |
| ESET-NOD32 | a variant of MSIL/GenKryptik.GKHZ |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.Ransom.Loki.2976 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1365403 |
| FireEye | Gen:Variant.Ransom.Loki.2976 |
| Fortinet | MSIL/AgentTesla.BEDA!tr |
| GData | Gen:Variant.Ransom.Loki.2976 |
| Detected | |
| Ikarus | Trojan.MSIL.Krypt |
| Jiangmin | Trojan.PSW.MSIL.eoco |
| K7AntiVirus | Trojan ( 005a5b091 ) |
| K7GW | Trojan ( 005a5b091 ) |
| Kaspersky | HEUR:Trojan-PSW.MSIL.Agensla.gen |
| Kingsoft | Win32.Troj.Generic.jm |
| Lionic | Trojan.Win32.Agensla.i!c |
| Malwarebytes | Crypt.Trojan.MSIL.DDS |
| MaxSecure | Trojan.Malware.74499699.susgen |
| McAfee | GenericRXWA-BS!3A94A458AB6A |
| McAfeeD | ti!19ED2682196C |
| MicroWorld-eScan | Gen:Variant.Ransom.Loki.2976 |
| Microsoft | Trojan:MSIL/LokiBot.CXRF!MTB |
| NANO-Antivirus | Trojan.Win32.GenKryptik.jxherk |
| Paloalto | generic.ml |
| Panda | Trj/Chgt.AD |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:tu1y6lun5wdzwyCvTsXdSg) |
| Sangfor | Infostealer.Msil.Lokibot.Viwm |
| SentinelOne | Static AI - Suspicious PE |
| Skyhigh | BehavesLike.Win32.Generic.tc |
| Sophos | Troj/MSIL-TAR |
| Symantec | Scr.Malcode!gdn34 |
| Tencent | Malware.Win32.Gencirc.13beee4c |
| VBA32 | TScope.Trojan.MSIL |
| VIPRE | Gen:Variant.Ransom.Loki.2976 |
| Varist | W32/MSIL_Agent.FKP.gen!Eldorado |
| ViRobot | Trojan.Win.Z.Agensla.1609728 |
| VirIT | Trojan.Win32.Genus.QQR |
| Webroot | W32.Malware.gen |
| Yandex | Trojan.Igent.bZ960J.16 |
| Zillya | Trojan.Agensla.Win32.25230 |
| huorong | TrojanSpy/MSIL.AgentTesla.ln |