MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177
SHA3-384 hash: 65cd7c28b1b63f411768e70576da6aceb0c9260c60854b922319153a43e7f5378beb8e14d0644bc5baab31bde6a60d7e
SHA1 hash: e7b4002f0a5eac2f40299175e219b513b87ddba1
MD5 hash: d0b9c781c2f213a822e2a695328d07aa
humanhash: social-south-yellow-east
File name:4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'206'272 bytes
First seen:2026-06-08 09:59:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'011 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 24576:IKxzaoK+wecdRMsKS8NbKBqpJQFo0AC4LdYCVib9:pzaoK+w1vgSAbKMQo7aGG9
TLSH T1FC452358AB04C80ACCB71BB50A29F3B55269DEDFE910C2179FFBBD677775A109898300
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 943930161e3e260e (2 x a310Logger, 1 x AgentTesla)
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b596404a-c11a-4f75-827a-1386f91b87b0/
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70011/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen5.33534.9148.10622.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2693603e9eff6a6b68c3b2
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Launching a process
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed vbnet
Link:
https://www.filescan.io/uploads/6a26929b8161ac6cb55cb9ff/reports/bf711f7c-a6e8-4bf2-ac08-f765135c58f6/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-20T01:17:00Z UTC
Last seen:
2026-06-04T03:40:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/959d01a2-a58d-4d18-a041-2de8bf711788
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeyLogger
Create hunting rule
Status:
Malicious
First seen:
2026-06-08 10:18:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
error
a310Logger
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/260608-l2qxwsbz9n/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177
MD5 hash:
d0b9c781c2f213a822e2a695328d07aa
SHA1 hash:
e7b4002f0a5eac2f40299175e219b513b87ddba1
Link:
https://www.unpac.me/results/faeb7c7f-b08b-4443-a43b-924c07c82483/
SH256 hash:
7e5e42651838afcb21918d7c4cec7d2a3352a51bd32f572a8a889e47cedb7c89
MD5 hash:
bc5c24037c01c45d357e78aae1457f88
SHA1 hash:
8b6115e53004c4330550467a4d67c509dc98452b
Link:
https://www.unpac.me/results/faeb7c7f-b08b-4443-a43b-924c07c82483/
SH256 hash:
bab3b43558a3c1de2aee7014b8d50306d19f67399836066bd50f1dfedf053664
MD5 hash:
71948b29e1ae6ade71c104f09f8c122d
SHA1 hash:
96c3809d12b34331b823305e7ab7daa0905af742
Link:
https://www.unpac.me/results/faeb7c7f-b08b-4443-a43b-924c07c82483/
SH256 hash:
52342acbe63dda893c6413c050b0274e65077a24f3600832c864e73f78552066
MD5 hash:
e334ab2ae2836f2510dc6d2252649dad
SHA1 hash:
a5d9d2f6e06bdffb3256a1e5afb2121724c360fb
Detections:
darkcloudstealer
Create hunting rule
Link:
https://www.unpac.me/results/faeb7c7f-b08b-4443-a43b-924c07c82483/
SH256 hash:
9eba765f1048ff2a018e906ad1ec8a93e60340d9dea0e12cbd7fd426950ab22e
MD5 hash:
e9eecb48c5edd8f666164da96fa51c1f
SHA1 hash:
fe40d6688f7ffa39b7e72a5523a96ba57e05be2f
Link:
https://www.unpac.me/results/faeb7c7f-b08b-4443-a43b-924c07c82483/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/faeb7c7f-b08b-4443-a43b-924c07c82483/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/70011/

Comments