MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
SHA3-384 hash: 245823fe378560401372692995dec54159547bb79b9c7d4346f4483e2fba02d91b1d6c2ddbb5b99ae1212111baf9b933
SHA1 hash: 685954f3acb78744dd38eb381a7bccd44742e296
MD5 hash: 9a9eee97619579a15d94d91e657d7dac
humanhash: uncle-leopard-mars-angel
File name:37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'260'040 bytes
First seen:2025-10-09 14:16:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:s0MDF1lYYk0GYBU16ZYGWFYu30ZjKlu8e:WGYlEEZYTXEZOluZ
Threatray 550 similar samples on MalwareBazaar
TLSH T19045CE413399DF01D56F1AF5C8B2C2F40727AE44EC01D3C76ADABEAB39B23916951293
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
Verdict:
Malicious activity
Analysis date:
2025-10-09 15:49:03 UTC
Tags:
stealer telegram evasion
Link:
https://app.any.run/tasks/51f4ef86-f3ea-42f4-a3c6-da3eab553460

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31426/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e7c4dd277c2bd8bc5e6434
Tags:
virus smtp msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Stealing user critical data
Setting a single autorun event
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm invalid-signature obfuscated packed packed packer_detected signed
Link:
https://www.filescan.io/uploads/68e7cb09f377ab2310553064/reports/1c5324a7-84d5-4916-a459-6c53fa50cb2e/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-19T04:55:00Z UTC
Last seen:
2025-10-09T07:15:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3be9e782-e9a5-44ab-9cbc-8c44b4ad52cb
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.42 Win 32 Exe x86
Link:
https://app.malva.re/file/9a9eee97619579a15d94d91e657d7dac
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1/
Threat name:
ByteCode-MSIL.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2025-09-19 09:13:48 UTC
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
unc_loader_078
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
a310Logger
444e6f22cad08e4dd2e50397b6f85f8649b1f384a338f8da07530e1f433341c9
a310Logger
b66c743bab45b7b02a5697b6f1794b69a792f7e57cd4388b9fbe312ae79bf537
a310Logger
cb0444e0d6694bb3aff429734dac57c823ebbbaf08742338de107000cf092864
a310Logger
dc822bf7d695ba868679506e564c997c5ff7c2ec8db8b7c8a4606a79a28a9ac3
a310Logger
error
a310Logger
+ 540 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud defense_evasion discovery persistence spyware stealer
Link:
https://tria.ge/reports/251009-r5s5baznw3/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
DarkCloud
Darkcloud family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8419968582:AAF2Ih0DDTGTvwoS8MCoHMWzWLxVW7nzxtE/sendMessage?chat_id=5366689155
Verdict:
Malicious
Tags:
DarkCloud
YARA:
n/a
Link:
https://app.threat.zone/submission/a009981a-33c4-4624-b6ef-cccf02eac992
Unpacked files
SH256 hash:
37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
MD5 hash:
9a9eee97619579a15d94d91e657d7dac
SHA1 hash:
685954f3acb78744dd38eb381a7bccd44742e296
Link:
https://www.unpac.me/results/fad682ef-2e5a-4fe7-bb50-9f4b77046f2f/
SH256 hash:
754487af1ac72e6d9f92fb6e9f89433763a9d38d321dd92cb30f943a4619c438
MD5 hash:
f3d9f46173d1a9b7a394dfd237b8a05f
SHA1 hash:
7d0d2d0b3e1a733d1818a2c6587d597b8637e718
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/fad682ef-2e5a-4fe7-bb50-9f4b77046f2f/
SH256 hash:
b2ac00d97c373c7efe7b9a54ce8b9f8b317ef919f29c45e3cdcfac3545674800
MD5 hash:
3d4e92fe67d6c1780f213fd51c36df1f
SHA1 hash:
8285892de43aa6bf4fd6bb52d05c937095c7b1be
Link:
https://www.unpac.me/results/fad682ef-2e5a-4fe7-bb50-9f4b77046f2f/
SH256 hash:
d9a450978aa965019a85ac4123ca2c18b64de342ef3e1db6ee90daaa59f07dc0
MD5 hash:
6ccdcab0188675c13cd94074480df123
SHA1 hash:
99571e53441823ebec3697a3f54bba39ae8f67f2
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/fad682ef-2e5a-4fe7-bb50-9f4b77046f2f/
Parent samples :
cb0444e0d6694bb3aff429734dac57c823ebbbaf08742338de107000cf092864
e17202f7475e7591c9b183af853c2c1a8c1b61561b0befbcd248aa49c28f3e50
37aa39b83b7657e3040a0b0bb4923d6d14f6dedf90b00641d931a14d38049ca1
1bcc1883153beceb890785de4f7a622ebabc8308f02c64a8cb3338ffa7318145
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31426/

Comments