MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36
SHA3-384 hash: 93046f43de8b6ccc5147e29fde91389324becd436d8fb6770bfffd721f4fe903b8e1ec57ce471e3e5fab4be5277050fe
SHA1 hash: 0fea7218a4e25da8c7ef741db0b96d6b72400ddb
MD5 hash: 30c2b04274e8fe5cb4245f9ac0837976
humanhash: aspen-summer-fruit-wisconsin
File name:51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'342'464 bytes
First seen:2025-11-06 11:21:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:pO07XV2vBtkePbwCfGd4nCWRu2VsIDI1ZP1E8ee:pHkvBB0C+d4nCWRuuY9ce
Threatray 2'084 similar samples on MalwareBazaar
TLSH T11C55F11B3E16FE36C37456BF0410E2B456649D5999D4E2037EEEFB9F7C39E062904282
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36
Verdict:
No threats detected
Analysis date:
2025-11-06 20:00:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2b56ae7e-93d2-4d59-922d-6c056b08433f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/36148/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c84f35a5ed7864e237d00
Tags:
virus micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-24T21:51:00Z UTC
Last seen:
2025-11-04T16:21:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/416607c6-7320-4cad-8c6e-5f03621ba07e
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.38 Win 32 Exe x86
Link:
https://app.malva.re/file/30c2b04274e8fe5cb4245f9ac0837976
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-10-25 01:21:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
28 of 37 (75.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kh3u2ocgq7b52iq5gpebuoakhidgg7f6hfhjifmodztpzbbony3a._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
darkcloudstealer
Create hunting rule
Similar samples:
04bb87af9d457db9e52f561272e1702ec4df1c9c569a3c3c1d67f57dec95a5ae
a310Logger
0de1bc51417ff52dbd8dea0137ce230d6ee9f0ecf5c8b8391288ac4be7f40337
a310Logger
2c3a611bea6cc4b910ba984a106510c25cfd40435ebdc45df46611603e0c1118
a310Logger
34159f583493176fa487b30736078ffbf9394ecc7b3af5386e146d0144c26117
a310Logger
39d894a43445e9c565e929ff4a83703c0db8e4b130aa0c40feb4fc1d836a4dc7
a310Logger
bfb08f6e69c9a8702f612f5c0e90599ef48c9d7270cc5a88611ff7555be2d0e1
a310Logger
+ 2'074 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/251106-ngr1kazrcv/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ba44785a-c5f0-47a8-bfe4-172bca965140
Unpacked files
SH256 hash:
51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36
MD5 hash:
30c2b04274e8fe5cb4245f9ac0837976
SHA1 hash:
0fea7218a4e25da8c7ef741db0b96d6b72400ddb
Link:
https://www.unpac.me/results/24f1f25f-bd77-47f3-ac09-35b26710ffd9/
SH256 hash:
e5729805917100f4bef523f2df9e4bd38632f1c7be791672b7040ac0a7d2d698
MD5 hash:
bc8a90a3d22caf25da597e43929ef11e
SHA1 hash:
03875c1cbb7d2bb64d90bacd6db68d6919d92359
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/24f1f25f-bd77-47f3-ac09-35b26710ffd9/
Parent samples :
7df6b618671a3611467c87986631bfeebf6508d857f51046053f5a502e4e0684
34159f583493176fa487b30736078ffbf9394ecc7b3af5386e146d0144c26117
51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36
2d9c058afa584eb05584fb5a1012dc013a7ebd2d9331d3269ab111e44e0a2cc2
a008bbcb7eed325eb375f6e8f3e74c72048e4d159f3b996490f73ad99b76b33e
SH256 hash:
af8d007134e68a665b991d4ce9edb54d93b1796ca87f09341c3003f818a50a56
MD5 hash:
3795323fd83d88ece3160ac67c425db4
SHA1 hash:
769e5abb8cd185791569e3d96487498f62fd4a56
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/24f1f25f-bd77-47f3-ac09-35b26710ffd9/
SH256 hash:
ee19121a12168d0d5f56b77110fa6e8a664098e3861d78251fdb17fcae7b0aa1
MD5 hash:
b030e327af1f32ac205f75bcc57f90bf
SHA1 hash:
fe03b5417ec80909cc308db614872e4d025ad260
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/24f1f25f-bd77-47f3-ac09-35b26710ffd9/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/24f1f25f-bd77-47f3-ac09-35b26710ffd9/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/51f74d384687/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51f74d384687c3dd221d33c81a380a3a06637cbe394e94158e1e66fc842e6e36

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/36148/

Comments