MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 756555660b6d49c5090db8367c86edad286d30512e8fb5d4b65dec2c75dd006d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
a310Logger
Vendor detections: 15
| SHA256 hash: | 756555660b6d49c5090db8367c86edad286d30512e8fb5d4b65dec2c75dd006d |
|---|---|
| SHA3-384 hash: | ad35c10ec682c3c310fba34c8be0dae87ec0fece6856c0aa84ab977f10da1059d29ecd91f9c4066831e667acb3fe36ae |
| SHA1 hash: | 843ba4e1c7cdecd2d908a894c9531f49f4a59113 |
| MD5 hash: | 9c424d6e7622f1952c1220046d81a02c |
| humanhash: | sixteen-december-two-video |
| File name: | Order Inquiry_19062023.exe |
| Download: | download sample |
| Signature | a310Logger |
| File size: | 1'927'744 bytes |
| First seen: | 2023-06-20 06:55:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | bf5a4aa99e5b160f8521cadd6bfe73b8 (432 x RedLineStealer, 31 x AgentTesla, 12 x DCRat) |
| ssdeep | 49152:xkQTAHb52zYLef/LU2qGsY/FVbSfVWdEzHH1dEpBMcgOx7hD:xaHbcKI/Ls0VbSKwH1dEnM0hD |
| Threatray | 1 similar samples on MalwareBazaar |
| TLSH | T1559523117781C4B6C537413A98D5CAA89EB02433572653CB778E4BB39F813E3A76A2DC |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| Reporter |  lowmal3 |
| Tags: | a310logger exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
295
Origin country :
DEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order Inquiry_19062023.exe
Verdict:
Malicious activity
Analysis date:
2023-06-20 07:01:28 UTC
Tags:
darkcloud
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
greyware overlay packed
Verdict:
Malicious
Labled as:
Malware
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkCloud
Verdict:
Malicious
Result
Threat name:
DarkCloud, RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Drops PE files to the user root directory
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes or reads registry keys via WMI
Writes to foreign memory regions
Yara detected DarkCloud
Yara detected Generic Dropper
Yara detected RedLine Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2023-06-20 06:39:34 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
6 of 37 (16.22%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Result
Malware family:
darkcloud
Score:
10/10
Tags:
family:darkcloud stealer
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
DarkCloud
Malware Config
C2 Extraction:
https://api.telegram.org/bot5671318275:AAGisFrFLqhVJjO72egJPifm2Q0ITZ6Nziw/sendMessage?chat_id=553496422
Unpacked files
SH256 hash:
32187cc480fecdf37c93af2f7da83ba74bc67b8ab1e47966498922e837e51f5f
MD5 hash:
1e463fb4fa660a02d99369822856169b
SHA1 hash:
79f158c75c72437fb69ca2eeeeffa9ec112c78ff
SH256 hash:
2c67c2376623541860caf62aa5a5040260b400a63c8121bad012a8d23aedec95
MD5 hash:
d1f1daf6cfcde87314691034f8f61e00
SHA1 hash:
2577f2f103ceafff486373a0f5c52ffce56e05b9
SH256 hash:
3b1554f891d6bd53f3e22d239aee3b5772f4f8ba2993ae2690a9e13cd1e09097
MD5 hash:
3901ed96ea81e179d7c61972ee9ef604
SHA1 hash:
10e0122c2a80822f1d0ce69749ee4ce939ae0970
SH256 hash:
f03457ba1d1427703c2fa5054173679c5941a8238c3dc2732d1fdee3b8066efb
MD5 hash:
3ca9bd5815686d7295642b0de8616aa6
SHA1 hash:
10266a1ddfc19cdcfb625032863d5e4471aa4e3c
SH256 hash:
837d3b3a89cced64c8334bbd7fdb0fe735bdaff38fa6c12d431120b6cbfadde3
MD5 hash:
a7e350d8e7d88b71a96b24427d516968
SHA1 hash:
0b2e25209c5a761958a4c464d9d2c7e485de43e3
SH256 hash:
756555660b6d49c5090db8367c86edad286d30512e8fb5d4b65dec2c75dd006d
MD5 hash:
9c424d6e7622f1952c1220046d81a02c
SHA1 hash:
843ba4e1c7cdecd2d908a894c9531f49f4a59113
Malware family:
RedNet
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing SQL queries to confidential data stores. Observed in infostealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_TelegramChatBot |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables using Telegram Chat Bot |
| Rule name: | MALWARE_Win_A310Logger |
|---|---|
| Author: | ditekSHen |
| Description: | Detects A310Logger |
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | MAL_Malware_Imphash_Mar23_1 |
|---|---|
| Author: | Arnim Rupp |
| Description: | Detects malware by known bad imphash or rich_pe_header_hash |
| Reference: | https://yaraify.abuse.ch/statistics/ |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | PE_Potentially_Signed_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.