MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab
SHA3-384 hash: 495465cd2f7c1601488641b2187a40da8038b5adafe9421bffadf74a4608c3a6e4f27f73f0fd52bf3e376ba15326975d
SHA1 hash: e4546f870e7a64cde16f6b0572fdadb5a33ac58f
MD5 hash: b3585e1e720fe5ef6bd6475c008e2725
humanhash: zulu-march-illinois-hamper
File name:1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab
Download: download sample
Signature a310Logger
Create hunting rule
File size:892'416 bytes
First seen:2025-11-06 10:34:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'751 x AgentTesla, 19'657 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 24576:iGMqbFSrdfA1ngeXU9ipIwogl0IV5e0HfFB:FBFcfA1m9i2iV5Tfv
Threatray 3'679 similar samples on MalwareBazaar
TLSH T16F1512946B1AD306E8666BB81A71F774073A6EECA952D2134FDCADEF7437B040D10293
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
27396- TEKLİF İSTEME FORMU.exe
Verdict:
No threats detected
Analysis date:
2025-10-14 06:42:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/61b69308-9bd9-4b5c-8f8d-b6867f150cdc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/35788/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c79cb5a5ed7864e2371ec
Tags:
shell virus micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Stealing user critical data
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-14T03:33:00Z UTC
Last seen:
2025-11-07T10:31:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c7232aac-84cc-45e9-be5d-082cc4634ad0
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.50 Win 32 Exe x86
Link:
https://app.malva.re/file/b3585e1e720fe5ef6bd6475c008e2725
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-10-14 09:54:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dqrt6fwfqsta5yk4qde53f3jktpxfrqdkmilj7lftebh7tbyq2vq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
darkcloudstealer
Create hunting rule
Similar samples:
0c4ddbd6eaf2b8f542d80ac82433f743b694a637a508ed91c4b4a1d5a0996f7c
a310Logger
0ca81580a2ed80ceb0e7dacabf505540acaee2670736174009477c86f2febaac
a310Logger
1a67e3d11a02fc98db956a82340065c8e1f5fd39db75bbe4d0e21262e9fffc9d
a310Logger
5b3e77fd20a7cf117f2808112403368d97e16e5569fbb0541f2fd9aec8a23dbf
a310Logger
aa7f31356193b7ed4e58e0ccc15635e3df06eaba6a81c0ff23bd68f17db18b87
a310Logger
acf15ed6b74d0d5c68bc209e463ffb144678073784fba3eef8a82dfde56002a6
a310Logger
+ 3'669 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery execution spyware stealer
Link:
https://tria.ge/reports/251106-mmdvfsvpdr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
DarkCloud
Darkcloud family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/95f87d27-fc7f-41ab-94ee-ff0dce01b3dd
Unpacked files
SH256 hash:
1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab
MD5 hash:
b3585e1e720fe5ef6bd6475c008e2725
SHA1 hash:
e4546f870e7a64cde16f6b0572fdadb5a33ac58f
Link:
https://www.unpac.me/results/2e6173fc-5624-4b60-a69d-ba035e847d6a/
SH256 hash:
cb74f2d1f1f6a034be2b0afbb91f382e5a326f0385fa1a86eab6d4a6f48aa9c1
MD5 hash:
d71d7591abde07e302e861d13fb7a08d
SHA1 hash:
05c931e4cdc4447f37e8e114a2a99f065ade987b
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/2e6173fc-5624-4b60-a69d-ba035e847d6a/
Parent samples :
5b3e77fd20a7cf117f2808112403368d97e16e5569fbb0541f2fd9aec8a23dbf
1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab
d9b95a04c5575c7f213470f305d822d01d6e6ba9066a93a2e85bb1bdc31d853a
SH256 hash:
2a5c0884646179bcc657613521436d0a9c1e438ba5d03cfda94e486829a3e388
MD5 hash:
5df672fe80295908079df7e4031997ea
SHA1 hash:
78294dda3d813885b67fed1f9e91e0f31931e872
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/2e6173fc-5624-4b60-a69d-ba035e847d6a/
SH256 hash:
b6781edd819929c2fe8b41985314c4eaed3c35ce05a61cdf911da3f09de53074
MD5 hash:
69fe9dc75c1792830f0a6d2525d05b22
SHA1 hash:
ae712836721804406194a813b91c7dd9f122d28c
Link:
https://www.unpac.me/results/2e6173fc-5624-4b60-a69d-ba035e847d6a/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/2e6173fc-5624-4b60-a69d-ba035e847d6a/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1c233f16c584/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c233f16c584a60ee15c80c9dd976954df72c6035310b4fd6599027fcc3886ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/35788/

Comments