MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e
SHA3-384 hash: fd745763291625ef779c22459f9bc5492c36793a835f4de0b08569de26b8c4db96c42a2b93ebbc6dd7ff30003e809fd4
SHA1 hash: 8942845b7d3eefddca9fdb2ffcd3355bfe8d34b4
MD5 hash: 538294f730be1b411da768c9c36dff6d
humanhash: winner-blossom-mockingbird-three
File name:793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'103'872 bytes
First seen:2026-06-08 09:52:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'011 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 24576:sUwAGdtOFrw8nvrnkLQiuua23DaK0ljsQkt:ExtOF08vr6Qgzah9k
Threatray 1'454 similar samples on MalwareBazaar
TLSH T1B63523F22ACDDA46C9B517BC1D60D13607605E98E961E32FCFF97CEBB02A3211915293
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5b6e4c31-1b34-426d-aab7-f1244c52454b/
Malware family:
n/a
ID:
1
File name:
793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e.exe
Verdict:
Malicious activity
Analysis date:
2026-06-08 10:09:11 UTC
Tags:
darkcloud stealer upx
Link:
https://app.any.run/tasks/845dd747-98b3-4721-95ce-cdc604e6155b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69961/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen5.33508.2833.28240.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2691323e9eff6a6b68c25d
Tags:
micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6a2691151f652d68656dd884/reports/237e08cf-e557-46cc-810d-c2ffb272f922/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-18T06:17:00Z UTC
Last seen:
2026-05-28T07:34:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f7c00f54-0a81-4e96-8fe7-4b82d07d1a3d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e/
Verdict:
Malicious
Threat:
Family.DARKCLOUD
Link:
https://tip.neiki.dev/file/793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e
Threat name:
Win32.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2026-05-18 14:58:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
27102d3e6bdb449f8bb0074e5249e4509978900d32deec0152fe00b425421c1b
a310Logger
60c0c18173c6b4430932a9a324dfcd875e62ec977b12e0a006d3355544e48714
a310Logger
7453b269f3a38abda3d9e99702036f5f546ceb83108371693f3f62780e07ae5d
a310Logger
793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e
a310Logger
a461c9d09734b885b06d6c5b21c87b1569d307b5d180ebb83ce89862edef5a90
a310Logger
e2157f2dfc275d131eac1990497e890876dba0d381d605737a1f1d803508e442
a310Logger
error
a310Logger
+ 1'444 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery stealer
Link:
https://tria.ge/reports/260608-lwfjzaby9k/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Family: DarkCloud
Unpacked files
SH256 hash:
793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e
MD5 hash:
538294f730be1b411da768c9c36dff6d
SHA1 hash:
8942845b7d3eefddca9fdb2ffcd3355bfe8d34b4
Link:
https://www.unpac.me/results/273a5400-9c19-444d-a9c0-0efb625f452e/
SH256 hash:
a8e9af5d5db01b452944e83f445f25e3d3d04275127f12f8c368053b23c58694
MD5 hash:
a9e32f0739d267f3ba035595a0a1558c
SHA1 hash:
13db8d9b4a34689ef263de6734dc38bb58f7f795
Link:
https://www.unpac.me/results/273a5400-9c19-444d-a9c0-0efb625f452e/
SH256 hash:
ca18d3dd407b9dc21680f1df48cddfa789f5a379aafe2a8c0a2112db77f9c6f6
MD5 hash:
54224e9ed068e574aebf3814ef1959f3
SHA1 hash:
2ae3bdc40ac398d40ed244281190bc3140bcfba6
Link:
https://www.unpac.me/results/273a5400-9c19-444d-a9c0-0efb625f452e/
SH256 hash:
244248e50446b8a45dc2c7796c4cd584b1ededa424335efd860614b4c9e30f42
MD5 hash:
7b40e9ccb5b3041f874532eec9d0fc69
SHA1 hash:
910150d352c8fc3f739abb260b0da70a559c7137
Detections:
darkcloudstealer
Create hunting rule
Link:
https://www.unpac.me/results/273a5400-9c19-444d-a9c0-0efb625f452e/
Parent samples :
793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e
3a987fa4a27d9f55a06621e8bc00519e96797fe29160fd8d2cbe9663c50c0599
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/273a5400-9c19-444d-a9c0-0efb625f452e/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/793028ad3df8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69961/

Comments