MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 18


Intelligence 18 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23
SHA3-384 hash: 5ab6a670b6b84aabb41df49bf73d1a38799fa1db408b9a64cf22323bc7d0a4d213bfab226dfff74400060a5f08ced027
SHA1 hash: 1de10d7e4647cd21b56cc70c0da34a113c4fe95c
MD5 hash: 07978a135ab5873dad35f38a3eaea2d3
humanhash: muppet-nine-four-apart
File name:proforma Invoice Sheet.exe
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'362'944 bytes
First seen:2025-12-03 08:32:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1895460fffad9475fda0c84755ecfee1 (438 x Formbook, 139 x AgentTesla, 68 x a310Logger)
ssdeep 24576:f5EmXFtKaL4/oFe5T9yyXYfP1ijXdaz+sGQ2wjJ4JIst+wtIc1lxw:fPVt/LZeJbInQRaz+5WjSL
Threatray 1'031 similar samples on MalwareBazaar
TLSH T13955CF027391C062FFAB91334F5AF6115BBD79260123A62F13981DB9BE701B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter lowmal3
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
AutoIt
Details
AutoIt
extracted scripts and files
Link:
https://research.acce.ciphertechsolutions.com/results/cdcbcc0e-61e4-4564-84f1-44a384769386/
Malware family:
n/a
ID:
1
File name:
_cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23.exe
Verdict:
No threats detected
Analysis date:
2025-12-03 08:40:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1e26c695-62a0-4a6a-bc4e-40877698dc83

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42237/
Detection(s):
SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692ff593264b106bd64650bd
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script fingerprint installer-heuristic keylogger masquerade microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/692ff590ddcd694c78ba2096/reports/88606dbf-bb9c-4631-aaca-076e0af7bfc3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-02T22:31:00Z UTC
Last seen:
2025-12-05T06:32:00Z UTC
Hits:
~1000
Detections:
Trojan-PSW.Win32.DarkCloud.ceq Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Stelega.sb Trojan.Win32.Strab.sb Trojan-PSW.Win32.DarkCloud.sb Trojan.Win32.Inject.sb Trojan.MSIL.Donut.sb Trojan-PSW.Win32.Stealer.sb
Link:
https://opentip.kaspersky.com/cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1333fb1f-53f1-4de8-a9eb-af7214a298c6
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1825181
Signature
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Found malware configuration
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected DarkCloud
Yara detected Generic Dropper
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23/
Verdict:
Malicious
Threat:
VHO:Trojan-PSW.Win32.DarkCloud
Link:
https://tip.neiki.dev/file/cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-03 06:26:25 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
20 of 24 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z6zxks2w3j7clk73fg4mcztrrtyjnqfsmpmwda4c7acf7getb4rq._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
Similar samples:
1e77489c920a17e0290d04e8471c20a2e3437b89bd90b6c1874f95ffe919bf2a
a310Logger
393835ae5e1ef7e86a74b0b349df029a3d594ea351fc039b28142da85ea6c17e
a310Logger
9a185fa9a33723bbd7bc316e9fe0d0a7c3b843d320aa298f7183b15c707114a9
a310Logger
9a8fb5b27922f3d93f26b0592c7ca6f399097314c79388aeeba9c23b379ee868
a310Logger
+ 1'021 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/251203-kfd6jaxlcr/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0f1564ed-f790-4407-b501-60268997a029
Unpacked files
SH256 hash:
cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23
MD5 hash:
07978a135ab5873dad35f38a3eaea2d3
SHA1 hash:
1de10d7e4647cd21b56cc70c0da34a113c4fe95c
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
SH256 hash:
216d52d10ddebea1f7616fe1a652b7939c2f9b9cb638c4f39314773b655b929b
MD5 hash:
28538cc86aef114e2bd357701e9a417f
SHA1 hash:
080c7be82fa33c8470ee8f7560aa847570f25f24
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
SH256 hash:
750162c4aa5e5c9fa3733cee4a05104ac6362cb8666dd3cd243d076f5db9375d
MD5 hash:
135d15362cf290d4601b31dfe0421e73
SHA1 hash:
d7cffe5ca46788f2006100f17346f49ee7ddffa9
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
SH256 hash:
8750ec5b2eeafa36c1ba0b030aa7a85a3474c70699be46db93edcbc0516b1975
MD5 hash:
ac90e7e8857d649d266b3511faa80d26
SHA1 hash:
34fa608fa1d8ede37cd127096eff8db4bc1b86a5
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
SH256 hash:
dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab
MD5 hash:
073a17b6cfb1112c6c838b2fba06a657
SHA1 hash:
a54bb22489eaa8c52eb3e512aee522320530b0be
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
SH256 hash:
0bc5ebba39d49a65acdf78f60d28b7fad07e8a29598fa1f9f4c81faf084977ba
MD5 hash:
f21f55ba94cf8bd4341ff2e0bbb8b185
SHA1 hash:
28a1fe6313838151e54fe1f7e5e5d85dec61000c
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
Parent samples :
6c09d0c5a7febff2bada57011949af46ee990309122286001553572c89dd30da
8053ba1fb74f4eeb273ddccf7e7de80b061b27efa7d096207843b39c2c2ae7db
5e2afcb215a7f0c01ce7eb9fc81b51e3abb2c20a9353af6f83d178811e029681
249be5b9fb7e31b119a6422f1998a9972665980b690c95ccbd1923a4d083fc2f
3b504d803733fab4f75705dff7b109b2732e68d53fd4e510a9b863329452f4a8
cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23
c9255a2ac756df49c8a941c038a74ff864b4ec1035f8336dc940046d5d8482c5
4473fb8abff504355343e79d0cb536bb18b34bbd288c60c606b66f8afcc15d33
9ff06deb1d47ba0006d7c2a344a0182dad2b2aab90a82dbe53e69696c13cd9fa
47abf867b5077693b280ec7960c20db9e19f0351977643c4c7878d894ce862f4
29537242228108173e751587e713e771c71c5eca3af8c501b59aac3fdaf8c294
a4da1f0a04d200fcdfc2e462cdb980f10603625ebe20f7e00d1f9ce4db8b139e
5d4b524f9b429925045872d71ec2c66d364891f6ba976dcaa9c3f11da5d7b4ae
1f84e1decce2a26f6d53ab98b1450c1c8b1bf9f93a36509ae1c07adbc4ef85d4
edd746e29cc208af6c60f4777a918374a47a98d8f7fcab1ab96fc2716f944284
674b09b55cc35a7bf8af01eaad0721f304cc8e12af895838a49ee425a19ebc00
a33848fd0208127dfdda465b67a23d0b5ad7be3129d4740ed8943cf8a92c53d1
6a241a4a25a6e4bf81da4370c50f50ade426bd49ad13e2be88ccf4921408ccc3
bff490d7366c1fa13b1837e5415597f914b1a029a4e439e65357be923adbcd7c
SH256 hash:
34a2218ec25274ebb40f625df8120515fb54e37438cc63311a66d3f939160454
MD5 hash:
8880b62382bc66015bac81124f428d42
SHA1 hash:
aef8c961fb4f676dc2e05edca60f69ea48fe84ef
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
SH256 hash:
6d335bd38904d09311d7a9c5ddc3828253bb1427abe363d70e83d09fb124a927
MD5 hash:
c8521f2b062a624c360fb98c0e464027
SHA1 hash:
94d9f310e5037a21fe4b2fad1f7b9edec321a421
Link:
https://www.unpac.me/results/bb547eee-df75-42d5-8822-ea3f207652e3/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cfb3754b56da/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_A310Logger
Create hunting rule
Author:ditekSHen
Description:Detects A310Logger
Rule name:MALWARE_Win_DarkCloud
Create hunting rule
Author:ditekSHen
Description:Detects DarkCloud infostealer
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_DarkCloud_9905abce
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

a310Logger

Executable exe cfb3754b56da7e25abfb29b8c166718cf096c0b263d9618382f8045f98930f23

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/42237/

Comments