MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145
SHA3-384 hash: 601df57ea0b2103d25319fd484de38a016e312f5ef773fcf4cbd82e0f9f684591ca4ec5a54645e5de0aee9839376ab61
SHA1 hash: 92d4f283473084aa91b6bf79696b3001a3d0be66
MD5 hash: f42f46e4b0a16c66a2ca00f6932ac79e
humanhash: ink-paris-nitrogen-july
File name:1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'253'896 bytes
First seen:2025-10-09 14:27:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:IrOTWOS2jZD+mfEZlP51Db5OvgUu3cyzMFhJAHgbTZz8/:o6WOSkDPEZbxf3cyIrdHts
Threatray 672 similar samples on MalwareBazaar
TLSH T1CE45BD017399CF11D56F1BB0D8B2C2F817276E45ED10D3CB6AC9BEAB38B23956951283
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
46
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145
Verdict:
Malicious activity
Analysis date:
2025-10-09 18:24:45 UTC
Tags:
stealer evasion telegram
Link:
https://app.any.run/tasks/60c0cf88-b562-484d-99a0-3992ead5fdaf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31519/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e7c7f3277c2bd8bc5e6807
Tags:
injection virus msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Stealing user critical data
Setting a single autorun event
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm evasive invalid-signature obfuscated packed packed packer_detected signed vbnet
Link:
https://www.filescan.io/uploads/68e7d3e75a3bccf09ebf623e/reports/96cd244c-2a93-4912-bef2-25d4db9afbe1/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-22T04:11:00Z UTC
Last seen:
2025-10-09T07:45:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/84e3ed48-36ed-4e7c-bf53-257ff01f6a02
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2025-09-22 06:57:09 UTC
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpgbrayvhpwoxcihqxpe66tcf25lzayi6awgjkglgm4p7jzrqfcq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
darkcloudstealer
Create hunting rule
unc_loader_078
Create hunting rule
Similar samples:
37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
a310Logger
444e6f22cad08e4dd2e50397b6f85f8649b1f384a338f8da07530e1f433341c9
a310Logger
57056367b8b2d6593175645d7713c07f4c7fd0b8fbc917e563e0d12865584f7b
a310Logger
74227624a51478a2fafb8f24adc7eb69ff8f171defcdbdc865704b90928ec883
a310Logger
cb0444e0d6694bb3aff429734dac57c823ebbbaf08742338de107000cf092864
a310Logger
e17202f7475e7591c9b183af853c2c1a8c1b61561b0befbcd248aa49c28f3e50
a310Logger
error
a310Logger
+ 662 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud defense_evasion discovery persistence spyware stealer
Link:
https://tria.ge/reports/251009-svpvksvzfv/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
DarkCloud
Darkcloud family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8419968582:AAF2Ih0DDTGTvwoS8MCoHMWzWLxVW7nzxtE/sendMessage?chat_id=5366689155
Verdict:
Malicious
Tags:
DarkCloud
YARA:
n/a
Link:
https://app.threat.zone/submission/99b753a1-b499-4eeb-8d31-13f8c477c0d6
Unpacked files
SH256 hash:
1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145
MD5 hash:
f42f46e4b0a16c66a2ca00f6932ac79e
SHA1 hash:
92d4f283473084aa91b6bf79696b3001a3d0be66
Link:
https://www.unpac.me/results/9498b460-5d09-462a-af8e-ed1daf60f953/
SH256 hash:
a9eb6fbd4eb87485a57b582957c39f6963b5933278debfc02c50393c59ff6ec9
MD5 hash:
cbb3a03e08c5ddfe6ecc42b851f28c3e
SHA1 hash:
4589aaf07c58ac684efc7ed09f2fd15557796848
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9498b460-5d09-462a-af8e-ed1daf60f953/
SH256 hash:
b2ac00d97c373c7efe7b9a54ce8b9f8b317ef919f29c45e3cdcfac3545674800
MD5 hash:
3d4e92fe67d6c1780f213fd51c36df1f
SHA1 hash:
8285892de43aa6bf4fd6bb52d05c937095c7b1be
Link:
https://www.unpac.me/results/9498b460-5d09-462a-af8e-ed1daf60f953/
SH256 hash:
d9a450978aa965019a85ac4123ca2c18b64de342ef3e1db6ee90daaa59f07dc0
MD5 hash:
6ccdcab0188675c13cd94074480df123
SHA1 hash:
99571e53441823ebec3697a3f54bba39ae8f67f2
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/9498b460-5d09-462a-af8e-ed1daf60f953/
Parent samples :
cb0444e0d6694bb3aff429734dac57c823ebbbaf08742338de107000cf092864
e17202f7475e7591c9b183af853c2c1a8c1b61561b0befbcd248aa49c28f3e50
37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31519/

Comments