MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

a310Logger

Vendor detections: 18

Intelligence 18 IOCs YARA 24 File information Comments

SHA256 hash:	e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd
SHA3-384 hash:	7ebe8e007acec972d688f713e83ea37d8f8405397ae58648c890503e5a660bbdb4d910c715d826916046bc1a38927185
SHA1 hash:	bccf06373ee318abd335cc808d5580ec2173e97b
MD5 hash:	92ad344295eda9ed9f7b9239e148de4f
humanhash:	glucose-monkey-alpha-asparagus
File name:	transferencia interbancaria (BBVA).exe
Download:	download sample
Signature	a310Logger Create hunting rule
File size:	969'728 bytes
First seen:	2025-09-11 06:35:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	24576:3gFwxSYbgZ/dyEPVhTWVBBMAnllvCCqsBaUp:SYbgZdwvBnllXEo
Threatray	874 similar samples on MalwareBazaar
TLSH	T155252398979DDD43D96C8BBB5AF62B664330C1B2DB92F314F5E352AF10533CA1201927
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	abuse_ch
Tags:	a310logger BBVA exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

transferencia interbancaria (BBVA).exe

Verdict:

Malicious activity

Analysis date:

2025-09-11 06:59:34 UTC

Tags:

netreactor phishing ftp darkcloud

Link:

https://app.any.run/tasks/6394e384-9168-4c87-bc43-24a4426145ec

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DarkCloud

Link:

https://www.capesandbox.com/analysis/26847/

Detection(s):

Win.Packed.Msilheracles-10017859-0

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c26e01b20052598879ae28

Tags:

smartassembly packed virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated obfuscated packed packed packer_detected smartassembly smart_assembly

Link:

https://www.filescan.io/uploads/68c26e63dbc6f5a29c3f8dae/reports/bf0749af-46f7-4400-bfa8-b8c8e7d73815/overview

Verdict:

Malicious

Labled as:

MSIL.Mensa.Generic

Link:

https://www.hybrid-analysis.com/sample/e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-10T13:15:00Z UTC

Last seen:

2025-09-10T13:15:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd/results?tab=lookup

Malware family:

DarkCloud

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/485d23b5-5874-4594-99a2-d6f1c04b83f1

Result

Threat name:

DarkCloud, PureLog Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1775356

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected AntiVM3

Yara detected Costura Assembly Loader

Yara detected DarkCloud

Yara detected Generic Dropper

Yara detected PureLog Stealer

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd/

Threat name:

ByteCode-MSIL.Trojan.Heracles

Status:

Malicious

First seen:

2025-09-10 23:05:49 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4rwjjcnbfivwc376cvg2j6sdiv5gdryeiizsxbsc7xttu2psf7oq._file

Verdict:

malicious

Label(s):

darkcloudstealer

a310Logger

5554ca93846129bc28fdcbfcd24d49ee67a117498bd6bcd99a498c0c48c41288

a310Logger

81aaa4374132fce34696a55cac25f3ab2fcca844500f88d13e4f217cde9349ec

a310Logger

829c252a4c01f72b2f015d5d2990278518c64838dc1ec5efe395e3bdaf139892

a310Logger

a89e4904dda9cbb86124d8479fe68113e9b927626a902f185d1c9f76cc9144d6

a310Logger

bfc9ac7d4fedbbe1c2818c3f5a66035577b69f17be2d4f7180a7658935b384fa

a310Logger

e1fc2f034a2afc3aaca14122ada80071c3a0fc9cb53e52f9b1b73f4c966342cc

a310Logger

+ 864 additional samples on MalwareBazaar

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud discovery stealer

Link:

https://tria.ge/reports/250911-hkkg1azth1/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

DarkCloud

Darkcloud family

Verdict:

Malicious

Tags:

Win.Packed.Msilheracles-10017859-0

YARA:

n/a

Link:

https://app.threat.zone/submission/e97ccc33-e654-4afc-b545-7b4bcb678b4b

Unpacked files

SH256 hash:

e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd

MD5 hash:

92ad344295eda9ed9f7b9239e148de4f

SHA1 hash:

bccf06373ee318abd335cc808d5580ec2173e97b

Link:

https://www.unpac.me/results/d7f9b3cd-8722-4027-9ae4-14fb25e0fe4e/

SH256 hash:

a60017fe7a6c822bb177ae9319107bd592d74bb6c870118186aab81891bc80af

MD5 hash:

dff1b3d990bf8ea50f7dbdfa7d9a15bd

SHA1 hash:

2a5cd7e4bb0c582de4f4cb7fdfaa4e6f32fe2fba

Link:

https://www.unpac.me/results/d7f9b3cd-8722-4027-9ae4-14fb25e0fe4e/

SH256 hash:

19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372

MD5 hash:

4e29f75c0c51b9dec76955f0382d9541

SHA1 hash:

4899aa8e3f57339cbaec8faab777897a76fe1c3a

Link:

https://www.unpac.me/results/d7f9b3cd-8722-4027-9ae4-14fb25e0fe4e/

SH256 hash:

217b676d8304ea5b5052c59014cdd507e41289b06e05aa55cf45de3fe78e2405

MD5 hash:

79d64a98633db1eb27f89a258fa72200

SHA1 hash:

6d0a91e1db5260bce9d54dbf9267fa475092e649

Link:

https://www.unpac.me/results/d7f9b3cd-8722-4027-9ae4-14fb25e0fe4e/

SH256 hash:

206022f6a98ffd3ed53150cfb297bf2c7b59b5da1fbb9080734b6621128dc29f

MD5 hash:

c2ba0f62557fd0ca15520998c95622ae

SHA1 hash:

c057a6dfa82aaff8c8d3e0231951748e34f9d64d

Detections:

darkcloudstealer

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

INDICATOR_SUSPICIOUS_EXE_CC_Regex

MALWARE_Win_A310Logger

MALWARE_Win_DarkCloud

Link:

https://www.unpac.me/results/d7f9b3cd-8722-4027-9ae4-14fb25e0fe4e/

Parent samples :

81aaa4374132fce34696a55cac25f3ab2fcca844500f88d13e4f217cde9349ec
f152904e5d22122a4ccaa29fb03fbaf06fe030b319ee4fa6d10c30ad895b18c8
e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd
1aa8a0d186840fc2a6cf512d3064808b6ad405a12479842e93169bf479a0dc33
b21399e4283631c68a3e60d3f826df09815e8bbb50e1790b8266bad03f9b5b7d

Malware family:

PureCrypter

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e46c9489a12a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/e46c9489a12a2b616ffe154da4fa43457a61c70442332b8642fde73a69f22fdd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	darkcloud_stealer Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked darkcloud malware samples.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	INDICATOR_EXE_Packed_SmartAssembly Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with SmartAssembly

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_CC_Regex Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing credit card regular expressions

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_A310Logger Create hunting rule
Author:	ditekSHen
Description:	Detects A310Logger

Rule name:	MALWARE_Win_DarkCloud Create hunting rule
Author:	ditekSHen
Description:	Detects DarkCloud infostealer

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	ProtectSharewareV11eCompservCMS Create hunting rule
Author:	malware-lu

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	Windows_Trojan_DarkCloud_9905abce Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/26847/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample