MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 16


Intelligence 16 IOCs YARA 29 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750
SHA3-384 hash: 321ca0a038207c8a3152d43e1616b68df045345b4a1a075890207cb03b72f6c6294db6f3398fa9182a8730487af0c969
SHA1 hash: 6619f1964ab6c27a871e130665587a6edfc3beeb
MD5 hash: d5e3c35dc8d2599ef806abec5ae0e2d2
humanhash: winter-jupiter-beer-summer
File name:BBVA_____PAGO.exe
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'281'536 bytes
First seen:2026-06-02 06:47:21 UTC
Last seen:2026-06-08 07:49:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'192 x AgentTesla, 20'341 x Formbook, 12'364 x SnakeKeylogger)
ssdeep 24576:6bAEFT0DMNZgwbXDCeJ33X6LSWM2wZTiWy/mK+kdrodK:m3FQoNZxbFlXwsGWI5oA
TLSH T16C551254271DDE0AC4A62BB45A71E2B067B05ED8E912C2039FDBBDFFBC7E2511D05282
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
151
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/7090e8aa-34eb-41c8-bcc5-86287c5868a7/
Malware family:
n/a
ID:
1
File name:
_cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750.exe
Verdict:
Malicious activity
Analysis date:
2026-06-02 06:49:59 UTC
Tags:
netreactor auto-reg darkcloud stealer upx
Link:
https://app.any.run/tasks/47edca9e-ed2c-4e65-8849-cbe43c2ecb74

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68753/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.43352262.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a1e7cb7f8676ad4d3603d7e
Tags:
virus micro shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-29T16:30:00Z UTC
Last seen:
2026-06-03T23:20:00Z UTC
Hits:
~1000
Detections:
Trojan.MSIL.Inject.sb HEUR:Trojan.MSIL.Injector.gen Trojan.MSIL.Crypt.sb HEUR:Trojan.Win32.Generic HEUR:Backdoor.MSIL.XWorm.gen Trojan.Win32.Agent.sb Trojan-Spy.Agent.SMTP.C&C PDM:Trojan.Win32.Generic NetTool.PlainTextCredentials.SMTP.C&C
Link:
https://opentip.kaspersky.com/cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3adbb99a-2d82-43d5-aa57-b6b7dd33aece
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750/
Verdict:
Malicious
Threat:
Family.DARKCLOUD
Link:
https://tip.neiki.dev/file/cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750
Threat name:
Win32.Trojan.XWorm
Create hunting rule
Status:
Malicious
First seen:
2026-05-31 03:16:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
22 of 36 (61.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zls5natw34qqjj6hxtwuth66k5chy5ap2xh7xmos6jt3n7j5w5ia._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
error
a310Logger
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/260602-hks45sfv6t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750
MD5 hash:
d5e3c35dc8d2599ef806abec5ae0e2d2
SHA1 hash:
6619f1964ab6c27a871e130665587a6edfc3beeb
Link:
https://www.unpac.me/results/434245f0-7863-4486-b200-3aa9dcc42559/
SH256 hash:
e2bdbe9549b01fa70eb28e978e205171ead25085fdc043a0e8b70f52b88474a3
MD5 hash:
6e3fa357b325af6fcb2887cc91daad94
SHA1 hash:
2b9e6da9858d5a953fc3e7ef8afcdf6a4a6271e6
Detections:
triage_darkcloud_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/434245f0-7863-4486-b200-3aa9dcc42559/
Parent samples :
cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750
5e8140bc340f72cade2f464b6f9742c8236f544e0213e17cb74ca05a4d222b31
16f469e717eb1239369889464fdc3d421e83bc1480b6445a7972b3c4ea6ed397
c425d2cef1c3504759b1fc1c6f45b7b5e808d73a27006eca4fa982da314dd95a
SH256 hash:
10d329d21caaa130466427ff625d0bfae6b1f1d26adfefd9f81f8a63f85b88d0
MD5 hash:
8593639303535cbb65d16fdb01b61e5b
SHA1 hash:
5c91fc8aaa38114227fd329bc9159e5eca903f23
Link:
https://www.unpac.me/results/434245f0-7863-4486-b200-3aa9dcc42559/
SH256 hash:
540e87512e6d5c31500df244f5331e75cd22c60a31ec2fbb4e8e8520a505e0e5
MD5 hash:
c482525ab6823a4d095ceb2f93c0623d
SHA1 hash:
9668105031681ceb37490db868d440aeb1b01fd3
Link:
https://www.unpac.me/results/434245f0-7863-4486-b200-3aa9dcc42559/
SH256 hash:
5aef543f2aaa09031143ed0b9734dd693fa81b56dfe75f546df36ea394210131
MD5 hash:
706cd7eac9f2ec43307b7b4538a39a95
SHA1 hash:
e31f3775922f260fc3ba943eb2f2770f7b3b1112
Link:
https://www.unpac.me/results/434245f0-7863-4486-b200-3aa9dcc42559/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/434245f0-7863-4486-b200-3aa9dcc42559/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DarkCloud
Create hunting rule
Author:YungBinary
Description:https://x.com/YungBinary/status/1971585972912689643
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing credit card regular expressions
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_A310Logger
Create hunting rule
Author:ditekSHen
Description:Detects A310Logger
Rule name:MALWARE_Win_DarkCloud
Create hunting rule
Author:ditekSHen
Description:Detects DarkCloud infostealer
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Trojan_DarkCloud_9905abce
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

a310Logger

Executable exe cae5d68276df2104a7c7bced499fde57447c740fd5cffbb1d2f267b6fd3db750

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68753/

Comments