MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 14


Intelligence 14 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
SHA3-384 hash: 40f18304dccbdecc258c9837b01fe086fb39d19b84f3bc5a8fcf7bcb57d29e29cbbc6303d8fbefc68573d9d5eff6faa9
SHA1 hash: a9e1f243e04e496127729dd6c63d4cffd0e43438
MD5 hash: 2cd090caf00756a9bc94d117c677cdb0
humanhash: arkansas-idaho-paris-johnny
File name:9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'281'536 bytes
First seen:2025-12-08 15:08:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 91d07a5e22681e70764519ae943a5883 (130 x Formbook, 32 x a310Logger, 27 x AgentTesla)
ssdeep 24576:Ztb20pkaCqT5TBWgNQ7azxt/cjDcD7tkS8FOXoNW6A:qVg5tQ7az7Uj7S8185
TLSH T12C55D01373DE8361C7725273BA26B7416EBF782506A1F96B2FD4093DE920122521EB73
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
AutoIt
Details
AutoIt
extracted scripts and files
Link:
https://research.acce.ciphertechsolutions.com/results/bcfaa14f-da2d-40bf-a4be-9d1598e1a56b/
Malware family:
n/a
ID:
1
File name:
9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
Verdict:
No threats detected
Analysis date:
2025-12-08 20:33:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d0552037-a437-4d9d-b793-0adebd5aa320

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43349/
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936ea6cdb58e1a2c22b8d02
Tags:
autoit emotet
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-17T20:39:00Z UTC
Last seen:
2025-12-09T00:28:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ac18617e-38d1-496b-b6b5-c937a34f7e0e
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/2cd090caf00756a9bc94d117c677cdb0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-11-18 00:59:39 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t7yg32y5i65aabwxykrujiayfwwswkvlscuc3pst42ljnqj43h5a._file
Verdict:
malicious
Label(s):
autoit
Create hunting rule
darkcloudstealer
Create hunting rule
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/251208-sjn4xaypbr/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e0d6fbb7-056d-4967-bce9-86d769c03fc8
Unpacked files
SH256 hash:
9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
MD5 hash:
2cd090caf00756a9bc94d117c677cdb0
SHA1 hash:
a9e1f243e04e496127729dd6c63d4cffd0e43438
Link:
https://www.unpac.me/results/9a25266f-3e26-4a1a-baf6-e7201eb68db8/
SH256 hash:
0bc5ebba39d49a65acdf78f60d28b7fad07e8a29598fa1f9f4c81faf084977ba
MD5 hash:
f21f55ba94cf8bd4341ff2e0bbb8b185
SHA1 hash:
28a1fe6313838151e54fe1f7e5e5d85dec61000c
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/9a25266f-3e26-4a1a-baf6-e7201eb68db8/
Parent samples :
6c09d0c5a7febff2bada57011949af46ee990309122286001553572c89dd30da
8053ba1fb74f4eeb273ddccf7e7de80b061b27efa7d096207843b39c2c2ae7db
5e2afcb215a7f0c01ce7eb9fc81b51e3abb2c20a9353af6f83d178811e029681
249be5b9fb7e31b119a6422f1998a9972665980b690c95ccbd1923a4d083fc2f
3b504d803733fab4f75705dff7b109b2732e68d53fd4e510a9b863329452f4a8
cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23
c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5
4473fb8abff504355343e79d0cb536bb18b34bbd288c60c606b66f8afcc15d33
9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
47abf867b5077693b280ec7960c20db9e19f0351977643c4c7878d894ce862f4
29537242228108173e751587e713e771c71c5eca3af8c501b59aac3fdaf8c294
a4da1f0a04d200fcdfc2e462cdb980f10603625ebe20f7e00d1f9ce4db8b139e
5d4b524f9b429925045872d71ec2c66d364891f6ba976dcaa9c3f11da5d7b4ae
1f84e1decce2a26f6d53ab98b1450c1c8b1bf9f93a36509ae1c07adbc4ef85d4
edd746e29cc208af6c60f4777a918374a47a98d8f7fcab1ab96fc2716f944284
674b09b55cc35a7bf8af01eaad0721f304cc8e12af895838a49ee425a19ebc00
a33848fd0208127dfdda465b67a23d0b5ad7be3129d4740ed8943cf8a92c53d1
6a241a4a25a6e4bf81da4370c50f50ade426bd49ad13e2be88ccf4921408ccc3
bff490d7366c1fa13b1837e5415597f914b1a029a4e439e65357be923adbcd7c
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/9a25266f-3e26-4a1a-baf6-e7201eb68db8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_A310Logger
Create hunting rule
Author:ditekSHen
Description:Detects A310Logger
Rule name:MALWARE_Win_DarkCloud
Create hunting rule
Author:ditekSHen
Description:Detects DarkCloud infostealer
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_DarkCloud_9905abce
Create hunting rule
Author:Elastic Security
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43349/

Comments