MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79
SHA3-384 hash: ca386eb929bb15c70dc48dad8ade35eedd0867d06b4e40c022309b28b9482d9d4652867e8eb8c40b7c5dfb0e178d13fd
SHA1 hash: 1c22ae36eed229adfc72ea82e07978f5530440f5
MD5 hash: 693a00bc9348b801a27d4a28620c0c86
humanhash: indigo-wolfram-hotel-colorado
File name:537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'200'128 bytes
First seen:2026-06-08 09:34:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'067 x AgentTesla, 20'020 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 24576:WPC9/wZPFw08599KdVPkk1+hiBj4ng67crLWTYuyjlX2O/XF7BI:WAePFw08rsnP1+6ENQfWTvyV2aI
TLSH T11045226C6A6AC117C59147301A71F2B8637E5EFDF905C3539FE8ACDFBA7AE444808242
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0af27da1-6b40-42b8-920b-19414e557286/
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69829/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a268da0ae2f98c00a68c8f9
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Creating a file
Forced shutdown of a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook krypt packed stealer
Link:
https://www.filescan.io/uploads/6a268d1d8161ac6cb55caaf7/reports/58cb3938-c652-4b29-bd45-1f71202d9fd6/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-12T15:42:00Z UTC
Last seen:
2026-06-09T17:04:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/27c261be-ce65-4839-8429-d2f5a7d64de3
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-05-12 20:55:49 UTC
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
error
a310Logger
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/260608-lln4cscs8z/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Uses the VBS compiler for execution
Unpacked files
SH256 hash:
537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79
MD5 hash:
693a00bc9348b801a27d4a28620c0c86
SHA1 hash:
1c22ae36eed229adfc72ea82e07978f5530440f5
Link:
https://www.unpac.me/results/4d226937-ba48-4dce-a97a-cc0333687a5d/
SH256 hash:
10d329d21caaa130466427ff625d0bfae6b1f1d26adfefd9f81f8a63f85b88d0
MD5 hash:
8593639303535cbb65d16fdb01b61e5b
SHA1 hash:
5c91fc8aaa38114227fd329bc9159e5eca903f23
Link:
https://www.unpac.me/results/4d226937-ba48-4dce-a97a-cc0333687a5d/
SH256 hash:
76106c072ed2281b10e7194dbc72d62eee252f3972418b7a51a870e8f96e47bd
MD5 hash:
834293dbbdcbe23006fe868880be1e8c
SHA1 hash:
870cca87d75df978314a42df89d19570c2c51039
Link:
https://www.unpac.me/results/4d226937-ba48-4dce-a97a-cc0333687a5d/
SH256 hash:
8b3b886d5059aa9b35607a3e2e1e04f9ee6b0d3dcdea27d431b9fe389c139287
MD5 hash:
74a7b4622e9ba5e0d9f7d2a8eb868f4a
SHA1 hash:
b359b5d03b82ad0ed505fc1947fcd32694a69491
Detections:
darkcloudstealer
Create hunting rule
Link:
https://www.unpac.me/results/4d226937-ba48-4dce-a97a-cc0333687a5d/
SH256 hash:
4404216edf49c1c6fd8adaf42e33b3f11a5eec5dcb201aff08f3e5828b7880d5
MD5 hash:
6cf7bc15e88ff1b0ffe8865499484209
SHA1 hash:
d6a64d229192de01710a26b52623abfa894877e6
Link:
https://www.unpac.me/results/4d226937-ba48-4dce-a97a-cc0333687a5d/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/4d226937-ba48-4dce-a97a-cc0333687a5d/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/537f7ca8cc64/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69829/

Comments