MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7384f35b91075ddc5b9d0451332f21b14e7631121a0fb759f7545fae2092b51a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
a310Logger
Vendor detections: 16
| SHA256 hash: | 7384f35b91075ddc5b9d0451332f21b14e7631121a0fb759f7545fae2092b51a |
|---|---|
| SHA3-384 hash: | 567dc74512e7495353b35e3b034c5456d5c78a5811dfa343aab9b65c6dd3d4c95ddb2adeba70f9ccdd25fcfb71060342 |
| SHA1 hash: | 28e0a5f0b7abbeb84d4eee1245872394456d9a26 |
| MD5 hash: | 0e02afb0578cc8379fa7e8974fafd597 |
| humanhash: | fix-carbon-timing-freddie |
| File name: | 7384f35b91075ddc5b9d0451332f21b14e7631121a0fb759f7545fae2092b51a |
| Download: | download sample |
| Signature | a310Logger |
| File size: | 1'019'392 bytes |
| First seen: | 2025-08-12 14:46:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 24576:Wg30pJH4w57+uBulpUdfcQjMBSHFItKQw:W2IJH5iuiBtLw |
| Threatray | 4'283 similar samples on MalwareBazaar |
| TLSH | T1542512847796C606E9FA6B355A72E2B44BF97D6A6D21C64E0FC9AC9F3834B40DC00353 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | a310logger exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
24
Origin country :
HUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7384f35b91075ddc5b9d0451332f21b14e7631121a0fb759f7545fae2092b51a
Verdict:
Malicious activity
Analysis date:
2025-08-12 22:03:58 UTC
Tags:
upx darkcloud
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Verdict:
Malicious
Score:
99.1%
Tags:
shell virus msil
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Trojan.Generic
Malware family:
KeyBase
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Family.DARKCLOUD
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2025-07-29 21:09:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 38 (71.05%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
darkcloudstealer
unc_loader_037
Similar samples:
+ 4'273 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Score:
10/10
Tags:
family:darkcloud discovery execution stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Command and Scripting Interpreter: PowerShell
DarkCloud
Darkcloud family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
7384f35b91075ddc5b9d0451332f21b14e7631121a0fb759f7545fae2092b51a
MD5 hash:
0e02afb0578cc8379fa7e8974fafd597
SHA1 hash:
28e0a5f0b7abbeb84d4eee1245872394456d9a26
SH256 hash:
25882602678594f221dee54acd2cbff527a64af51e0d196204c16e5aa51adcb4
MD5 hash:
946d19194775711579a1731fb3f72a64
SHA1 hash:
598aa6f503849bf5c85b12e5a943dec692658dc0
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
de0b9f32f36d6d9be0c5379446412f628365932bcd83831d141e55ffd26c2181
MD5 hash:
9e35ec8655f5fbbf9b9fdd39532ef425
SHA1 hash:
e44aa4775ed1f6b6300e564f5683e9ec7ad72a2a
Detections:
MALWARE_Win_A310Logger
Parent samples :
bde181e1225b6cb39fadcaf7a03659dcb8ba059eee626219b994f739b90e028c
7384f35b91075ddc5b9d0451332f21b14e7631121a0fb759f7545fae2092b51a
823cc22db5213f3bf401b4e744197a50dd9346e763cf745ce415db272f4cef77
474d294bea3318d16172b18f4a6df197d4681e6717cd721abd614bbe7b678e15
21de865e9982298bfb357c705c3c8b18fd0f5867df3e719f38b6a543484a6cca
d4e8cdc606eb4b7bd8261d9ab6cacaeba618c16cfae20c94641a18878af8fcce
7384f35b91075ddc5b9d0451332f21b14e7631121a0fb759f7545fae2092b51a
823cc22db5213f3bf401b4e744197a50dd9346e763cf745ce415db272f4cef77
474d294bea3318d16172b18f4a6df197d4681e6717cd721abd614bbe7b678e15
21de865e9982298bfb357c705c3c8b18fd0f5867df3e719f38b6a543484a6cca
d4e8cdc606eb4b7bd8261d9ab6cacaeba618c16cfae20c94641a18878af8fcce
SH256 hash:
6005f0e4563fef5e8abfdb88cacd5b3d8fd4cff04b1af93e8e01a9990f46d5c0
MD5 hash:
3f17ed370489371093c2a3d768cb6b07
SHA1 hash:
fb4f0ddcaf872e4c7850e4cefad59a2c62f54424
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Malware family:
DarkCloud
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| Rule name: | MALWARE_Win_A310Logger |
|---|---|
| Author: | ditekSHen |
| Description: | Detects A310Logger |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | ProtectSharewareV11eCompservCMS |
|---|---|
| Author: | malware-lu |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vba |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | win32_dotnet_form_obfuscate |
|---|---|
| Author: | Reedus0 |
| Description: | Rule for detecting .NET form obfuscate malware |
| Rule name: | Windows_Trojan_DarkCloud_9905abce |
|---|---|
| Author: | Elastic Security |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.