MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b
SHA3-384 hash: ef1cc28d929da8218b9da5a69e4d5f7e61ae8a0bad967cba9fb4f1adda97ddd35b91dd7ea4890e4d765cc7e218c3cee2
SHA1 hash: 491abfbda36ee0f1ef4301d1cb6565ef56a8305c
MD5 hash: eeea3e3aa38496e3dee89445cf26f7dd
humanhash: coffee-fourteen-stairway-lemon
File name:bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'209'344 bytes
First seen:2026-06-08 09:40:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'012 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 24576:hp+7lD2kGm9OUZ+pMCC37ExifTSQGc09VBfX:hpohEJEUSf2dcih
TLSH T1D3452368AA46E613DAC51B364E71F3B517AD5EDDA801D317CFE8BEEB7863B044C01182
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/87c07cad-c0b0-4d6c-9a9e-7825ec040673/
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69873/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a268ea53e9eff6a6b68c012
Tags:
agensla virus msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Forced shutdown of a system process
Stealing user critical data
Setting a single autorun event
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypt krypt packed
Link:
https://www.filescan.io/uploads/6a268e9c8161ac6cb55cac3d/reports/33a7d0d2-b828-4fa1-a182-c47b9310c98d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-14T13:18:00Z UTC
Last seen:
2026-06-09T07:33:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8e5f5dac-8e8c-4cf6-ad83-9d608f51c11f
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-05-14 21:34:08 UTC
AV detection:
16 of 20 (80.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
error
a310Logger
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/260608-lpa1xact51/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Uses the VBS compiler for execution
Unpacked files
SH256 hash:
bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b
MD5 hash:
eeea3e3aa38496e3dee89445cf26f7dd
SHA1 hash:
491abfbda36ee0f1ef4301d1cb6565ef56a8305c
Link:
https://www.unpac.me/results/ff31ac8a-ca43-4305-a71a-f30f0d2a0909/
SH256 hash:
f7d6e2c617287aefc849a9d8ef49d61c5dc562e25c8de051e5d05469aa80b081
MD5 hash:
a4dd6d2a168149e4bce343fea1e67d32
SHA1 hash:
46375520145b1148d20b981cccfeeb981fd4dd3b
Detections:
darkcloudstealer
Create hunting rule
Link:
https://www.unpac.me/results/ff31ac8a-ca43-4305-a71a-f30f0d2a0909/
Parent samples :
bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b
a4903ba8d565b62bfbcd98c98c45a1b8c46d11064bc0c06f1215b2ff9f5ff30c
b4f71a83ef2858a522aeb1fb0143abc94c1ef06baba2e317968dff9298030989
728ac47291c7eb020ce10ed5ec53f28ca03d6c7600db9ca18f702bbe6185a5c9
SH256 hash:
7852e84e04cb7df5e6ebd61ef24f9d360296dbe22a9d4eccc29c46cb34510309
MD5 hash:
7bb430c2f94fcdf5d878fb7633bd551b
SHA1 hash:
4b8f11cec36a2566972ba671f66d41896a092c19
Link:
https://www.unpac.me/results/ff31ac8a-ca43-4305-a71a-f30f0d2a0909/
SH256 hash:
10d329d21caaa130466427ff625d0bfae6b1f1d26adfefd9f81f8a63f85b88d0
MD5 hash:
8593639303535cbb65d16fdb01b61e5b
SHA1 hash:
5c91fc8aaa38114227fd329bc9159e5eca903f23
Link:
https://www.unpac.me/results/ff31ac8a-ca43-4305-a71a-f30f0d2a0909/
SH256 hash:
0a253f3af7fcaad33aa86f8d8ed4216517899bc9d584b8248a49d17fafb9d9df
MD5 hash:
5df98574c4b6883b80d7278249e93963
SHA1 hash:
701e971d378a0ce25d12f1a529ef0716dcaf3ded
Link:
https://www.unpac.me/results/ff31ac8a-ca43-4305-a71a-f30f0d2a0909/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/ff31ac8a-ca43-4305-a71a-f30f0d2a0909/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bd0d1f8cbc89/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69873/

Comments