MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fb623de58c14ac8cd4d6e7248d1a05f511b5c39bb868c1d5dc57b7854e84cde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fb623de58c14ac8cd4d6e7248d1a05f511b5c39bb868c1d5dc57b7854e84cde
SHA3-384 hash: e305587a7822a62d73900f2a1f27b5fb53c76de71c35903fb43fab042ecbbc0749bb44d9f4e0f72d0eb7eb8ab2f06013
SHA1 hash: 0bfcecd9b23b2e2ff7af91e7355ac7ed2705d995
MD5 hash: 144c71aa3c0921610e282c58749b5e39
humanhash: kansas-wyoming-march-quebec
File name:144c71aa3c0921610e282c58749b5e39
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'363'968 bytes
First seen:2021-09-11 07:46:05 UTC
Last seen:2021-09-11 10:21:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:GLpXk+b6umJBDAJeqtgbv6XFz4BD2kghLPwPJENfUO0hmh:GLfqBDAfgD6X5xkBha0hY
Threatray 111 similar samples on MalwareBazaar
TLSH T1B5559D0073D89E99E0DE2F34D0B12E1557BAAD12616ADF4A5D31B5EB2C723C0681B7B3
dhash icon 308a8a8c8c8a8a30 (6 x AgentTesla, 3 x Formbook, 2 x a310Logger)
Reporter zbetcheckin
Tags:32 a310logger exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
144c71aa3c0921610e282c58749b5e39
Verdict:
Malicious activity
Analysis date:
2021-09-11 07:49:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9b562031-a5f8-4b61-a69a-cb077467d781

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/187025/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46946973.18399.8502.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a36a0328-9f3d-4f8e-9e92-d87ad16677e7
Result
Threat name:
StormKitty a310Logger
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/849098
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected a310Logger
Yara detected StormKitty Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 481529 Sample: v4oeJd6Cqv Startdate: 11/09/2021 Architecture: WINDOWS Score: 100 67 Malicious sample detected (through community Yara rule) 2->67 69 Multi AV Scanner detection for dropped file 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 5 other signatures 2->73 8 v4oeJd6Cqv.exe 1 9 2->8         started        12 word.exe 2->12         started        process3 file4 47 C:\Users\user\AppData\Roaming\...\word.exe, PE32 8->47 dropped 49 C:\Users\user\AppData\...\v4oeJd6Cqv.exe, PE32 8->49 dropped 51 C:\Users\user\...\word.exe:Zone.Identifier, ASCII 8->51 dropped 53 2 other malicious files 8->53 dropped 75 Writes to foreign memory regions 8->75 77 Injects a PE file into a foreign processes 8->77 14 v4oeJd6Cqv.exe 8->14         started        17 powershell.exe 61 8->17         started        19 powershell.exe 8->19         started        21 8 other processes 8->21 signatures5 process6 signatures7 91 Multi AV Scanner detection for dropped file 14->91 93 Machine Learning detection for dropped file 14->93 95 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->95 97 4 other signatures 14->97 23 AppLaunch.exe 14->23         started        28 AppLaunch.exe 14->28         started        40 2 other processes 14->40 30 conhost.exe 17->30         started        32 conhost.exe 19->32         started        34 conhost.exe 21->34         started        36 conhost.exe 21->36         started        38 conhost.exe 21->38         started        42 5 other processes 21->42 process8 dnsIp9 59 icanhazip.com 104.18.7.156, 49774, 80 CLOUDFLARENETUS United States 23->59 61 90.168.9.0.in-addr.arpa 23->61 55 C:\Users\user\AppData\...\SszRrRug.exe, PE32 23->55 dropped 79 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->79 81 May check the online IP address of the machine 23->81 83 Tries to steal Instant Messenger accounts or passwords 23->83 44 SszRrRug.exe 23->44         started        63 104.18.6.156, 49775, 80 CLOUDFLARENETUS United States 28->63 65 90.168.9.0.in-addr.arpa 28->65 57 C:\Users\user\AppData\...\bIaVcUuW.exe, PE32 28->57 dropped 85 Tries to steal Mail credentials (via file access) 28->85 87 Tries to harvest and steal browser information (history, passwords, etc) 28->87 file10 signatures11 process12 signatures13 89 Multi AV Scanner detection for dropped file 44->89
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fb623de58c14ac8cd4d6e7248d1a05f511b5c39bb868c1d5dc57b7854e84cde/
Threat name:
ByteCode-MSIL.Trojan.Dothetuk
Create hunting rule
Status:
Malicious
First seen:
2021-09-09 01:45:58 UTC
AV detection:
25 of 45 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h63chxsyyffmrtknnzzerunal5irwxbzxodiyhk5yv5xqvhijtpa._file
Verdict:
malicious
Similar samples:
06671aa1c0e3f5552f64c537c302ccb4d94dc24a6e3a5f99d7ba31bc4b94b6c7
a310Logger
1c5e928b5e27daa837d1ba10187397303520f5b18cf9b5da1eaf28b7f2ba0eda
a310Logger
35d443578b1eb0708d334d3e1250f68550a5db4d630f1813fed8e2fc58a2c6d0
a310Logger
5ee445df1e4b2ff0a6bab7415c6951859b0e4c1ebcf2044ec1bd13d6a6a77d08
a310Logger
9091f8b24635fc68664a80f7904c1f56344c045513996852a522d5da2a909f73
a310Logger
c0ead704ef1d5b9a6d60c2c3ad3b68a95a0e4dbef4f0a6fa2a477cde84d461c7
a310Logger
cba897dc82a468040a082fd6135edecb8dcdcd0f0fe1375adeaeff3262cc6504
a310Logger
d6390558e6f860877f95e6cf83ebc2fa028da6f469d75f73b27afe92900fbc7f
a310Logger
f4b224dc05210c0020c5e2f736c3132de81057918783ed65e56add163f92d552
a310Logger
+ 101 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/210911-jmh8dsbbe3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
9c6c0ba9a3c403f6bfea116532bd263b204008186efa1752aed6ec23dc33c546
MD5 hash:
e03706314ee351dacc9e7390fb43dbbe
SHA1 hash:
cf8ce2c1dcf6749e10a1aaa92887bf99a1372c02
Link:
https://www.unpac.me/results/25e82ccc-69e1-4bc9-901f-ac9ac612dec6/
SH256 hash:
603b84b516a1b8e0969e26a7c4039500dba96a76c4495aea105d7ce52335b81f
MD5 hash:
0cc77eadb639601017334f2efa6d84ce
SHA1 hash:
a86b0d12c1a569e5c3f4ac27987ea3cd28f0e436
Link:
https://www.unpac.me/results/25e82ccc-69e1-4bc9-901f-ac9ac612dec6/
SH256 hash:
78e5abfec11433a13679ad8d09f1262332a8d4e908472b6b334db3b21598ca52
MD5 hash:
1688d9f48cb3ec89c1c2d54baa85be88
SHA1 hash:
70dd585e643c53ac3d0985df7b7137d64a7952de
Link:
https://www.unpac.me/results/25e82ccc-69e1-4bc9-901f-ac9ac612dec6/
SH256 hash:
3fb623de58c14ac8cd4d6e7248d1a05f511b5c39bb868c1d5dc57b7854e84cde
MD5 hash:
144c71aa3c0921610e282c58749b5e39
SHA1 hash:
0bfcecd9b23b2e2ff7af91e7355ac7ed2705d995
Link:
https://www.unpac.me/results/25e82ccc-69e1-4bc9-901f-ac9ac612dec6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3fb623de58c14ac8cd4d6e7248d1a05f511b5c39bb868c1d5dc57b7854e84cde

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

a310Logger

Executable exe 3fb623de58c14ac8cd4d6e7248d1a05f511b5c39bb868c1d5dc57b7854e84cde

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1610211/
Cape
Cape
https://www.capesandbox.com/analysis/187025/

Comments


Avatar
zbet commented on 2021-09-11 07:46:07 UTC

url : hxxp://52.47.201.149/R1/Z/BLT-018881033022.exe