MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
a310Logger
Vendor detections: 8
| SHA256 hash: | 8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987 |
|---|---|
| SHA3-384 hash: | f08ac357424b77ee31e727c152c4ceaacb87a8aaf1c9a4a19a607b8def23287e01a418440013a0ba2e99a3e0868edabd |
| SHA1 hash: | 235a213a7bb4fc944199ec54a04138c0c4d0150d |
| MD5 hash: | bd047836bb8805934054d02d6d4263f6 |
| humanhash: | coffee-mississippi-helium-pizza |
| File name: | SKQRMFE00058945.exe |
| Download: | download sample |
| Signature | a310Logger |
| File size: | 524'515 bytes |
| First seen: | 2021-08-24 06:22:47 UTC |
| Last seen: | 2021-08-24 13:50:53 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 76cb49957629b5fe0d40d13588a8762e (4 x Loki, 3 x Formbook, 2 x NanoCore) |
| ssdeep | 12288:TKhCCCCCCCCCCCCC1g5al+tpTQTujAyfiIsdCCCCCCCCCCCCCCCCCCC/c2XvB5+5:TKnfSIT+L4M6U/QjortrtmHTdSqBV+ |
| Threatray | 5'002 similar samples on MalwareBazaar |
| TLSH | T1B4B4123A3D8C5937F7AE74766EA551A6F5433E24B73C817260AA78138C7A90F78300B5 |
| Reporter |  AndreGironda |
| Tags: | a310logger CryptoWallets.zip exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
264
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SKQRMFE00058945.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-24 06:24:21 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Sending a UDP request
Launching a process
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file
Deleting a recently created file
Searching for the window
Creating a file in the %temp% directory
Moving a file to the %AppData% subdirectory
Replacing files
Unauthorized injection to a recently created process
Stealing user critical data
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
StormKitty a310Logger
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected a310Logger
Yara detected Generic Dropper
Yara detected StormKitty Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.Convagent
Status:
Malicious
First seen:
2021-08-24 06:23:05 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
2/5
Verdict:
malicious
Similar samples:
+ 4'992 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
a49ab099aa9eb6c6bc9629ca582cc8bb62de0da9bdad4c1b08448fb50d1d3126
MD5 hash:
b47ee4fcf1806eba54c7cd0c16d1a904
SHA1 hash:
9939d7353a34f65c0ec66dc48917aaeb9f9a64a5
SH256 hash:
0d87368d4b42b9a17cac14e5cc28d8e29c35549b625d71f1f90a46c4957e9e1b
MD5 hash:
13642c4bd311f810a93655fe07133420
SHA1 hash:
b52ea16b628f9cf1f68399088a6a3ce757f5807d
SH256 hash:
8fb7d7c33173d49da7907bf7bec5eea3d7d7f79ea3fef39bedf3de4b22f76987
MD5 hash:
bd047836bb8805934054d02d6d4263f6
SHA1 hash:
235a213a7bb4fc944199ec54a04138c0c4d0150d
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.53
File information
The table below shows additional information about this malware sample such as delivery method and external references.
021d7b39db0176851ef9a4dd9493fbb913c89cc03106c7b97314354da5e2f495
Link
Dropping
SHA256 021d7b39db0176851ef9a4dd9493fbb913c89cc03106c7b97314354da5e2f495
Dropping
SHA256 0d87368d4b42b9a17cac14e5cc28d8e29c35549b625d71f1f90a46c4957e9e1b
Dropping
SHA256 3f92c4d0fa014384ac318cb40a43850d9fe83205a8e909fdb0b492dadeee91ca
Dropping
SHA256 9be06b19f706980c4b758cd7d957dbb9d7da758aaba41bce6e7e95efbfb2a4c0
Dropping
SHA256 a49ab099aa9eb6c6bc9629ca582cc8bb62de0da9bdad4c1b08448fb50d1d3126
Dropping
SHA256 f991cb474ea42528278053f965223326389c3555cdd08de453c80c3d77e9b6f9
Delivery method
Distributed via e-mail link
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.