MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80
SHA3-384 hash: 6cc62322c45d5ee6a4b4cbd319361d5825aa30d0a0efd04a1b29ba5304672d5bc39137372b9690bd21162155c2302c80
SHA1 hash: 3e02b1803a0972043475f0d42a0131ca76ea3486
MD5 hash: 32f123142690747873c5fc7eb5be6e4d
humanhash: aspen-two-kansas-indigo
File name:785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'198'080 bytes
First seen:2026-06-08 09:31:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'011 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 24576:1WyujK85+/SN357ArBdYMVBXORvOmoOUjJCh7jI:1WP4IaJXmotChI
TLSH T1874523541A69E60BC59583394DB1F3B862BC0EDEB911D303CFECBEEFB669A544C04192
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/cef552a6-4797-4afc-9df3-89538dcac225/
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69813/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a268cbf3e9eff6a6b68bb9b
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Stealing user critical data
Setting a single autorun event
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
krypt packed stealer
Link:
https://www.filescan.io/uploads/6a268d381f652d68656dbf3f/reports/424f0115-9a3f-40ba-be42-f17b8ce7780c/overview
Verdict:
Malicious
Labled as:
VHO_TrojanPSW_MSIL_Stealer_gen
Link:
https://www.hybrid-analysis.com/sample/785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-12T13:54:00Z UTC
Last seen:
2026-06-09T08:14:00Z UTC
Hits:
~10000
Link:
https://opentip.kaspersky.com/785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/37c760e7-331a-4fda-93a6-e5a1556529e0
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-05-12 17:30:24 UTC
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
xworm
Create hunting rule
darkcloudstealer
Create hunting rule
Similar samples:
error
a310Logger
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/260608-ljnd2sbv2n/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Uses the VBS compiler for execution
Unpacked files
SH256 hash:
785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80
MD5 hash:
32f123142690747873c5fc7eb5be6e4d
SHA1 hash:
3e02b1803a0972043475f0d42a0131ca76ea3486
Link:
https://www.unpac.me/results/79d4c5ba-0f03-415c-aeee-5578a286356b/
SH256 hash:
10d329d21caaa130466427ff625d0bfae6b1f1d26adfefd9f81f8a63f85b88d0
MD5 hash:
8593639303535cbb65d16fdb01b61e5b
SHA1 hash:
5c91fc8aaa38114227fd329bc9159e5eca903f23
Link:
https://www.unpac.me/results/79d4c5ba-0f03-415c-aeee-5578a286356b/
SH256 hash:
76106c072ed2281b10e7194dbc72d62eee252f3972418b7a51a870e8f96e47bd
MD5 hash:
834293dbbdcbe23006fe868880be1e8c
SHA1 hash:
870cca87d75df978314a42df89d19570c2c51039
Link:
https://www.unpac.me/results/79d4c5ba-0f03-415c-aeee-5578a286356b/
SH256 hash:
88b1dd3595649407361a715f0e2e45efc7f7425c1be0fbb9985b31ee9af5c090
MD5 hash:
5ac1717b7acd191afd466ba34461021d
SHA1 hash:
b085036b0322e9709497312bc4c3fc2f25f84337
Detections:
darkcloudstealer
Create hunting rule
Link:
https://www.unpac.me/results/79d4c5ba-0f03-415c-aeee-5578a286356b/
SH256 hash:
c893896e26e7b32a514feb9141d92ab6a0a6ca63e39a3bc2ca1513d600647075
MD5 hash:
5cb772e56e5ddfa446de1e478dd725a4
SHA1 hash:
bd62f58de4e834de59d9a13a82c41e333f9925f1
Link:
https://www.unpac.me/results/79d4c5ba-0f03-415c-aeee-5578a286356b/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/79d4c5ba-0f03-415c-aeee-5578a286356b/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/785675de0fc6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69813/

Comments