MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a155b362ccb1506dbbf3c0500b917af50e12763997b6fcacfce490cbd032c55b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

a310Logger

Vendor detections: 13

Intelligence 13 IOCs YARA 4 File information Comments 1

SHA256 hash:	a155b362ccb1506dbbf3c0500b917af50e12763997b6fcacfce490cbd032c55b
SHA3-384 hash:	e45b1c7ab3c1a290251bf303443ca7beea99eca6b55c95252140b32f023fe0c879bb8d4ffe54626bae45ebd0427c9c2f
SHA1 hash:	6fe70050badd503f333e50de828be5636c126604
MD5 hash:	0322430745d6fc9bc218d7a9d877f60c
humanhash:	ink-sodium-carpet-enemy
File name:	0322430745d6fc9bc218d7a9d877f60c
Download:	download sample
Signature	a310Logger Create hunting rule
File size:	2'676'854 bytes
First seen:	2022-11-02 16:01:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bca6eef833a3a9c7d08eeaa3fa5b1e34 (3 x DarkCloud, 2 x a310Logger, 1 x Smoke Loader)
ssdeep	49152:eT/X4fPuLmqJ5IwP33spU+hKwHmdccq2mrVbS98ZfdxiRSx3c0Z9upE:0/22LxcAMa+hjqCZbS69h3RAE
TLSH	T1B1C533FA7524902EFB219A31227F9F43906C05AE7FCC57D03BA946E92B21F558BB3114
TrID	29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4505/5/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	06f692c2529ab2d2 (5 x DarkCloud, 2 x a310Logger, 2 x Floxif)
Reporter	zbetcheckin
Tags:	32 a310logger exe

Intelligence

File Origin

# of uploads :

# of downloads :

267

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0322430745d6fc9bc218d7a9d877f60c

Verdict:

Suspicious activity

Analysis date:

2022-11-02 16:05:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/188e7a39-6f5a-4f7d-8605-8bdb01e55849

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

A310Logger

Link:

https://www.capesandbox.com/analysis/327273/

Detection(s):

PUA.Win.Packer.ProtectSharewar-2

PUA.Win.Packer.ProtectSharewar-3

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for analyzing tools

Searching for the window

Сreating synchronization primitives

Creating a window

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6362947dce1f43143c2a7809/reports/78e34fe9-d5b9-4631-970a-c0606f557e14/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/34d6448f-bda2-45a7-b515-9564764ccafb

Result

Threat name:

DarkCloud

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1103460

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Writes or reads registry keys via WMI

Yara detected DarkCloud

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a155b362ccb1506dbbf3c0500b917af50e12763997b6fcacfce490cbd032c55b/

Threat name:

Win32.Backdoor.Cardinal

Status:

Malicious

First seen:

2022-11-02 16:02:14 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ufk3gywmwfig3o7tybiaxel26uhbe5rzs63pzlh44simxubsyvnq._file

Verdict:

malicious

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud evasion stealer themida trojan

Link:

https://tria.ge/reports/221102-tgr88aaba3/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Checks BIOS information in registry

Themida packer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

DarkCloud

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/929620dd-eae5-4408-a8dd-157bb0b02b8e

Unpacked files

SH256 hash:

3a32d856f5b8346028686d3d8d819ebbb196e96d23b185463c1954453edefdaf

MD5 hash:

b6799c064f7a41ecdbb6cba903569de0

SHA1 hash:

4a1e2a325799e5954c78a5b82c3e7c1049964895

Link:

https://www.unpac.me/results/9b9426f9-6e5a-4aae-9558-4094150a9ac3/

SH256 hash:

884eded8f7150720be4181e21c7165a49235c0e1029417b87361418f176ae628

MD5 hash:

602d5be52e40f4479668c6f2c10dc9f7

SHA1 hash:

3db3c20e06756f57d062066d9c12c2b77acbebf9

Link:

https://www.unpac.me/results/9b9426f9-6e5a-4aae-9558-4094150a9ac3/

SH256 hash:

3a32d856f5b8346028686d3d8d819ebbb196e96d23b185463c1954453edefdaf

MD5 hash:

b6799c064f7a41ecdbb6cba903569de0

SHA1 hash:

4a1e2a325799e5954c78a5b82c3e7c1049964895

Link:

https://www.unpac.me/results/9b9426f9-6e5a-4aae-9558-4094150a9ac3/

SH256 hash:

a155b362ccb1506dbbf3c0500b917af50e12763997b6fcacfce490cbd032c55b

MD5 hash:

0322430745d6fc9bc218d7a9d877f60c

SHA1 hash:

6fe70050badd503f333e50de828be5636c126604

Link:

https://www.unpac.me/results/9b9426f9-6e5a-4aae-9558-4094150a9ac3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/a155b362ccb1506dbbf3c0500b917af50e12763997b6fcacfce490cbd032c55b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers