MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 18


Intelligence 18 IOCs YARA 27 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb
SHA3-384 hash: c56636a54d1b4b7e5256364e1c80615ad9bcd1fa7c2c54072f235a6aecf22363cf093422e877c151258f9fe726df6ed7
SHA1 hash: 21d9a73f135fe2beebb1f254061d7bcbdd82668c
MD5 hash: bd6cc6112cccca6dc0b0127786703eb9
humanhash: purple-cup-july-indigo
File name:gBMVHgAre5ESXA2.exe
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'276'416 bytes
First seen:2026-08-13 15:54:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'192 x AgentTesla, 20'344 x Formbook, 12'365 x SnakeKeylogger)
ssdeep 24576:mMmuaaHiawo2x4r1AgdcV6TIzR6POqQnxRxUORR:mMmuaauo2MA+uld6P+W8
TLSH T1324512942309DE02D9639BF45930D7B81BB86ED5B820D3179EEA7DEBB83671428443D3
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter FXOLabs
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
BR BR
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/8c25c7de-ffc4-46ba-a8dc-6262fbd3e955/
Malware family:
guloader
Create hunting rule
ID:
1
File name:
unknown
Verdict:
Malicious activity
Analysis date:
2026-08-12 17:10:51 UTC
Tags:
netreactor darkcloud stealer auto-reg guloader loader telegram upx
Link:
https://app.any.run/tasks/49489509-dfd2-47da-a42a-9059b2a6a2d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/80915/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed vbnet
Link:
https://www.filescan.io/uploads/6a7de8fd127fc9b0cfad458c/reports/84e66dcd-f4f7-47e0-9af3-6e0e3f9e306c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-12T04:33:00Z UTC
Last seen:
2026-08-14T11:33:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d1d3b467-670b-484b-87d1-9c3da8c6fce6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb
Verdict:
inconclusive
YARA:
8 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.41 Win 32 Exe x86
Link:
https://app.malva.re/file/bd6cc6112cccca6dc0b0127786703eb9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeyLogger
Create hunting rule
Status:
Malicious
First seen:
2026-08-12 11:25:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdzjcuiolgqnteuybhm5pxr4ygky34jocrrurfnfcp4v4prxw7fq._file
Verdict:
malicious
Label(s):
DarkCloudStealer
Create hunting rule
Link:
https://reports.threatray.com/d4088151-4bc2-4170-8962-a5901ddcba18
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery execution persistence stealer
Link:
https://tria.ge/reports/260813-tc428atcqh/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: DarkCloud
Unpacked files
SH256 hash:
a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb
MD5 hash:
bd6cc6112cccca6dc0b0127786703eb9
SHA1 hash:
21d9a73f135fe2beebb1f254061d7bcbdd82668c
Link:
https://www.unpac.me/results/e8617843-6556-4fa4-99b3-620b44d7b9e2/
SH256 hash:
143c7bfe4e9c140f0994d00b1dc8007a3deff7116e2bc40998d088304d822134
MD5 hash:
a7c2163eabb4540b77e48a516f19f7da
SHA1 hash:
072f5edae4ea1bf8c5a4e4c0962cde023a8f63e3
Detections:
darkcloudstealer
Create hunting rule
Link:
https://www.unpac.me/results/e8617843-6556-4fa4-99b3-620b44d7b9e2/
SH256 hash:
76e498f6c3056812a6aa5dab98d61ce4f38fb688de62766a3d6b233f68a51f0b
MD5 hash:
68a9e112ca72295fa5caac73cc65232a
SHA1 hash:
36d946402d86bf9e2e06c58dca1afe57258e7b11
Link:
https://www.unpac.me/results/e8617843-6556-4fa4-99b3-620b44d7b9e2/
SH256 hash:
bab3b43558a3c1de2aee7014b8d50306d19f67399836066bd50f1dfedf053664
MD5 hash:
71948b29e1ae6ade71c104f09f8c122d
SHA1 hash:
96c3809d12b34331b823305e7ab7daa0905af742
Link:
https://www.unpac.me/results/e8617843-6556-4fa4-99b3-620b44d7b9e2/
SH256 hash:
7acd43433dcdd2388d2dc7ca2f5203f5eb40043d258d650c495dbd7a810b2185
MD5 hash:
1288212665389d90b9c2e56f183975a2
SHA1 hash:
fadaa0800186c169dc650f2745675d9da9efda70
Link:
https://www.unpac.me/results/e8617843-6556-4fa4-99b3-620b44d7b9e2/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/e8617843-6556-4fa4-99b3-620b44d7b9e2/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a8f291510e59/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DarkCloud
Create hunting rule
Author:YungBinary
Description:https://x.com/YungBinary/status/1971585972912689643
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing credit card regular expressions
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_A310Logger
Create hunting rule
Author:ditekSHen
Description:Detects A310Logger
Rule name:MALWARE_Win_DarkCloud
Create hunting rule
Author:ditekSHen
Description:Detects DarkCloud infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:UPX
Create hunting rule
Author:kevoreilly
Description:UPX Unpacker: dump on OEP (original entry point)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Trojan_DarkCloud_9905abce
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

a310Logger

Executable exe a8f291510e59a0d9929809d9d7de3cc1958df12e14634895a513f95e3e37b7cb

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/80915/

Comments