MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 17


Intelligence 17 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e
SHA3-384 hash: 6c937bc17c4ce4c925f6abe8358be42ea4513c6beb8a00356d117c29d5f4bacfc1c160b416cc3be467c02cfe5e5c27e2
SHA1 hash: 53de5389599204b6f24c6ba807145cafc23c657e
MD5 hash: e3492e3f226937e47adda1c699a6a1ed
humanhash: india-cardinal-comet-spring
File name:937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'339'904 bytes
First seen:2026-02-05 15:18:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1ce208b1192bfcf652c179f34f034d3 (32 x AgentTesla, 22 x Formbook, 5 x a310Logger)
ssdeep 24576:J5EmXFtKaL4/oFe5T9yyXYfP1MAXDzVhYakC1+PuTHl5057mhAMU5dpJ+:JPVt/LZeJbInGizVNq2TEhmLU5
Threatray 1'242 similar samples on MalwareBazaar
TLSH T19155CF0273C1C062FFAB91734F5AF6115BBC79260123A62F13981DBAB9705B1563E7A3
TrID 50.4% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
19.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.5% (.EXE) Win32 Executable (generic) (4504/4/1)
3.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:a310logger exe upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e
File size (compressed) :833'536 bytes
File size (de-compressed) :1'339'904 bytes
Format:win32/pe
Packed file: 937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
AutoIt
Details
AutoIt
extracted scripts and files
Link:
https://research.acce.ciphertechsolutions.com/results/f50c354a-26cf-44b4-8fe0-a2978c228ab3/
Malware family:
n/a
ID:
1
File name:
937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e
Verdict:
Malicious activity
Analysis date:
2026-02-05 17:44:23 UTC
Tags:
auto-startup
Link:
https://app.any.run/tasks/539fd165-e0fc-4666-af93-8d44c353960c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51983/
Detection(s):
SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.Embedpe-3
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6984b4d1117f8ed80109c8b9
Tags:
autoit emotet
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-15T23:46:00Z UTC
Last seen:
2026-01-18T05:55:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ed126171-e3a2-4c58-88d0-e13d4a56b0b0
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1864090
Signature
Binary is likely a compiled AutoIt script file
Drops VBS files to the startup folder
Found API chain indicative of sandbox detection
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: Drops script at startup location
Sigma detected: WScript or CScript Dropper
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected DarkCloud
Yara detected Generic Dropper
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1864090 Sample: 937606f11433eea5aa8ee24a716... Startdate: 05/02/2026 Architecture: WINDOWS Score: 100 31 Found malware configuration 2->31 33 Malicious sample detected (through community Yara rule) 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 7 other signatures 2->37 7 937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e.exe 4 2->7         started        11 wscript.exe 1 2->11         started        process3 file4 25 C:\Users\user\AppData\Local\...\troopwise.exe, PE32 7->25 dropped 45 Binary is likely a compiled AutoIt script file 7->45 47 Found API chain indicative of sandbox detection 7->47 49 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->49 51 Unusual module load detection (module proxying) 7->51 13 troopwise.exe 2 7->13         started        53 Windows Scripting host queries suspicious COM object (likely to drop second stage) 11->53 55 WScript reads language and country specific registry keys (likely country aware script) 11->55 17 troopwise.exe 1 11->17         started        signatures5 process6 file7 27 C:\Users\user\AppData\...\troopwise.vbs, data 13->27 dropped 57 Multi AV Scanner detection for dropped file 13->57 59 Binary is likely a compiled AutoIt script file 13->59 61 Drops VBS files to the startup folder 13->61 63 Switches to a custom stack to bypass stack traces 13->63 19 svchost.exe 43 13->19         started        65 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 17->65 67 Writes to foreign memory regions 17->67 69 Maps a DLL or memory area into another process 17->69 23 svchost.exe 39 17->23         started        signatures8 process9 dnsIp10 29 149.154.166.110 TELEGRAMRU United Kingdom 19->29 39 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 19->39 41 System process connects to network (likely due to code injection or exploit) 23->41 43 Tries to harvest and steal browser information (history, passwords, etc) 23->43 signatures11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/e3492e3f226937e47adda1c699a6a1ed
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-01-16 04:40:56 UTC
File Type:
PE (Exe)
Extracted files:
27
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j7vnrdqbne243a3aozo6uxwct25xbqeplvtvnqzjzl43hcguvgha._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
0ae822a90eaf7160e1fb51cf94fdf6bced5acb72f2f1c1bc2ba220950f4b5289
a310Logger
1f8238b656161f5e598be3a069926d03b1554bdcfd079d0fb11604a64255d368
a310Logger
81aaa4374132fce34696a55cac25f3ab2fcca844500f88d13e4f217cde9349ec
a310Logger
a89e4904dda9cbb86124d8479fe68113e9b927626a902f185d1c9f76cc9144d6
a310Logger
error
a310Logger
f1be8acbb066d665acd6f4811ecccd4bfb2985ec05b793ba41866c9430c8abf9
a310Logger
+ 1'232 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery stealer
Link:
https://tria.ge/reports/260205-spsz2shy3h/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Drops startup file
Executes dropped EXE
DarkCloud
Darkcloud family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8440824913:AAEKra-VNyC-HzKnLTGW77TGFjZtKwoIhUk/sendMessage?chat_id=7362332542
Unpacked files
SH256 hash:
4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e
MD5 hash:
e3492e3f226937e47adda1c699a6a1ed
SHA1 hash:
53de5389599204b6f24c6ba807145cafc23c657e
Link:
https://www.unpac.me/results/35553adf-8391-4fb6-bdce-d0c741e6930d/
SH256 hash:
cdf615a95f9bcd9abc5a42413bbd7ca50f01bdb76d6a42d9956e062b273218ed
MD5 hash:
e5bd55bd9d5bfb50786496d36fc2eb61
SHA1 hash:
4e400098d77a20b55f42810218f6edf2db0a8ef3
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/35553adf-8391-4fb6-bdce-d0c741e6930d/
Parent samples :
0937e2e1e027827ce1b50f2c290236ae0e8cf604dddfcae4b2b57a5b6bdb2426
0ae822a90eaf7160e1fb51cf94fdf6bced5acb72f2f1c1bc2ba220950f4b5289
937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e
4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e
d1c9c2f4cfd087b3eb5d7ece5b4a9111c494bc34217b4d60ab85beba1a36e082
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/35553adf-8391-4fb6-bdce-d0c741e6930d/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4fead88e0169/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DarkCloud
Create hunting rule
Author:YungBinary
Description:https://x.com/YungBinary/status/1971585972912689643
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing credit card regular expressions
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_A310Logger
Create hunting rule
Author:ditekSHen
Description:Detects A310Logger
Rule name:MALWARE_Win_DarkCloud
Create hunting rule
Author:ditekSHen
Description:Detects DarkCloud infostealer
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_DarkCloud_9905abce
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

a310Logger

Executable exe 937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e

a310Logger

Executable exe 4fead88e016935cd8360765dea5ec29ebb70c08f5d6756c329caf9b388d4a98e

(this sample)

  
Dropped by
SHA256 937606f11433eea5aa8ee24a7163d6ddc7a8a16747e1346dd26762d2a97fd39e
Cape
Cape
https://www.capesandbox.com/analysis/51983/
  
Dropped by
MD5 eb9516ca0f0f8dc7119cbd7a4f157a67

Comments