MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 18


Intelligence 18 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5
SHA3-384 hash: c7881f0b9502c5e637222efc0a40eefcebaf2e3c2ad7f4fef2f867382b9ed854c5746fd36f6dbc54e272d6cd90361cdc
SHA1 hash: 21bf5f9a37e4ddadd68ddef8baa83227738f4363
MD5 hash: 8d67638028a66cf778acee0e08b22f40
humanhash: nine-six-salami-low
File name:proforma Invoice Sheet.exe
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'362'944 bytes
First seen:2025-12-05 11:42:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1895460fffad9475fda0c84755ecfee1 (438 x Formbook, 138 x AgentTesla, 68 x a310Logger)
ssdeep 24576:R5EmXFtKaL4/oFe5T9yyXYfP1ijXda7wWiwW1KQRdwAhVw5u:RPVt/LZeJbInQRa7MRNbwN
Threatray 1'172 similar samples on MalwareBazaar
TLSH T14555CF027381D062FFAB92334B5AF6115ABC79260123EA1F13981DB9FD705B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter lowmal3
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
AutoIt
Details
AutoIt
extracted scripts and files
Link:
https://research.acce.ciphertechsolutions.com/results/6e6e6cf8-b849-4720-a7ed-57cb638458f6/
Malware family:
n/a
ID:
1
File name:
proforma Invoice Sheet.exe
Verdict:
No threats detected
Analysis date:
2025-12-05 11:44:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0c3075a3-4724-4f3e-817a-4be16eca3415

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42637/
Detection(s):
SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6932c5535ae9dd4b467d3bfd
Tags:
autoit emotet
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script fingerprint installer-heuristic keylogger masquerade microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6932c551bba50eaf0422e402/reports/76e21ddf-72cb-46fc-bbdd-bea7dcc844e8/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-04T21:22:00Z UTC
Last seen:
2025-12-07T09:29:00Z UTC
Hits:
~1000
Detections:
Trojan-PSW.Win32.Stealer.sb Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic Trojan.Win32.Inject.sb Trojan-PSW.Win32.DarkCloud.cgs Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.DarkCloud.sb Trojan.Win32.Strab.sb Trojan.MSIL.Donut.sb
Link:
https://opentip.kaspersky.com/c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c6262ff5-ed92-4497-b180-e92d0272b80c
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1827170
Signature
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Found malware configuration
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected DarkCloud
Yara detected Generic Dropper
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5
Verdict:
Malware
YARA:
7 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/8d67638028a66cf778acee0e08b22f40
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5/
Verdict:
Malicious
Threat:
Win32.Trojan.AutoitInject
Link:
https://tip.neiki.dev/file/c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-12-05 03:40:52 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zesvukwhk3putsfjihadrj2p7bslj3aqgx4dg3ojiacg2xmeqlcq._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
1e77489c920a17e0290d04e8471c20a2e3437b89bd90b6c1874f95ffe919bf2a
a310Logger
393835ae5e1ef7e86a74b0b349df029a3d594ea351fc039b28142da85ea6c17e
a310Logger
9a185fa9a33723bbd7bc316e9fe0d0a7c3b843d320aa298f7183b15c707114a9
a310Logger
9a8fb5b27922f3d93f26b0592c7ca6f399097314c79388aeeba9c23b379ee868
a310Logger
+ 1'162 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/251205-nvnv3azjbn/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3d7f5c59-e84f-499e-9160-d967f2829e53
Unpacked files
SH256 hash:
c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5
MD5 hash:
8d67638028a66cf778acee0e08b22f40
SHA1 hash:
21bf5f9a37e4ddadd68ddef8baa83227738f4363
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
SH256 hash:
bab4bd53df7bab965708f4167314af337a849a3c84ab711059a600742ee8746d
MD5 hash:
8e9c14fb7448b8ea01c823618c817720
SHA1 hash:
2d59f9bea0c61574d9034efcbbed0b6db6ab8081
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
SH256 hash:
b080f444883240c647ebd1d023201d675f60f58f0b0e319a78a3bfd6b9768ea4
MD5 hash:
1b3b0f63deab8e8ef90df9f7731e3700
SHA1 hash:
facdd1a5406131f13f12a51e8b1bfc03754f0bc9
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
SH256 hash:
a7b73bdc63e6da848a7919cc146b34d0a3fa13c0810c79f9b7eb51db7a45223f
MD5 hash:
129f979f710d20c501e13f217f56273b
SHA1 hash:
8b20e644a3f53227b3239739f31c88c0a4ec41fa
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
SH256 hash:
dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab
MD5 hash:
073a17b6cfb1112c6c838b2fba06a657
SHA1 hash:
a54bb22489eaa8c52eb3e512aee522320530b0be
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
SH256 hash:
0bc5ebba39d49a65acdf78f60d28b7fad07e8a29598fa1f9f4c81faf084977ba
MD5 hash:
f21f55ba94cf8bd4341ff2e0bbb8b185
SHA1 hash:
28a1fe6313838151e54fe1f7e5e5d85dec61000c
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
Parent samples :
6c09d0c5a7febff2bada57011949af46ee990309122286001553572c89dd30da
8053ba1fb74f4eeb273ddccf7e7de80b061b27efa7d096207843b39c2c2ae7db
5e2afcb215a7f0c01ce7eb9fc81b51e3abb2c20a9353af6f83d178811e029681
249be5b9fb7e31b119a6422f1998a9972665980b690c95ccbd1923a4d083fc2f
3b504d803733fab4f75705dff7b109b2732e68d53fd4e510a9b863329452f4a8
cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23
c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5
4473fb8abff504355343e79d0cb536bb18b34bbd288c60c606b66f8afcc15d33
9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
47abf867b5077693b280ec7960c20db9e19f0351977643c4c7878d894ce862f4
29537242228108173e751587e713e771c71c5eca3af8c501b59aac3fdaf8c294
a4da1f0a04d200fcdfc2e462cdb980f10603625ebe20f7e00d1f9ce4db8b139e
5d4b524f9b429925045872d71ec2c66d364891f6ba976dcaa9c3f11da5d7b4ae
1f84e1decce2a26f6d53ab98b1450c1c8b1bf9f93a36509ae1c07adbc4ef85d4
edd746e29cc208af6c60f4777a918374a47a98d8f7fcab1ab96fc2716f944284
674b09b55cc35a7bf8af01eaad0721f304cc8e12af895838a49ee425a19ebc00
a33848fd0208127dfdda465b67a23d0b5ad7be3129d4740ed8943cf8a92c53d1
6a241a4a25a6e4bf81da4370c50f50ade426bd49ad13e2be88ccf4921408ccc3
bff490d7366c1fa13b1837e5415597f914b1a029a4e439e65357be923adbcd7c
SH256 hash:
366cb387012c169707a63f806a3dcdab1ca17b34f4fde45f4382e6b57b8d8a69
MD5 hash:
4cee1ec64f11458a30e8c52d417dda15
SHA1 hash:
78979a019e1dcce3a2c03046ec6e1feb4c6f1810
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
SH256 hash:
d80f4efd95578547454b4f67754be7f72c2a5491e2588720ced95c5c5952bdea
MD5 hash:
9bf2f58adabf07c8554c1d7e798faf5c
SHA1 hash:
f87e1555a5b363aba635d3899d68a5c4e53a7ab4
Link:
https://www.unpac.me/results/3b422172-fae0-43d3-856d-d7de0f2843fc/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c9255a2ac756/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_A310Logger
Create hunting rule
Author:ditekSHen
Description:Detects A310Logger
Rule name:MALWARE_Win_DarkCloud
Create hunting rule
Author:ditekSHen
Description:Detects DarkCloud infostealer
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_DarkCloud_9905abce
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

a310Logger

Executable exe c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/42637/

Comments