MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 14


Intelligence 14 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692
SHA3-384 hash: 3cfc591c5d7f5f58484c54f3a7438cdc8380e59ac29cf5ecd99faac0978f3ad13395e4fa0dabf195aaf2bcf84b4549c0
SHA1 hash: 5a7bdc3476d04397529e1ffcc09ceca3b349e6d0
MD5 hash: 2d74d33bd6378e4a37a0baa651349b47
humanhash: carpet-vermont-washington-spring
File name:ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692
Download: download sample
Signature a310Logger
Create hunting rule
File size:1'376'768 bytes
First seen:2025-08-12 13:53:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Ztb20pkaCqT5TBWgNQ7aYGlmyjdjbO7QeYrg6A:qVg5tQ7aYg3dv4D55
Threatray 2'691 similar samples on MalwareBazaar
TLSH T1A255D01263DDC364C3B25273BA26BB01AEBF782506A5F56B2FD40D3DF920162521E673
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter adrian__luca
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
28
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692
Verdict:
No threats detected
Analysis date:
2025-08-12 14:46:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6ed3bef7-af78-4afa-b51a-203617ea6114

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DarkCloud
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20408/
Detection(s):
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b481ac633abe3908e49df
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Restart of the analyzed sample
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context autoit cmdkey compiled-script fingerprint fingerprint keylogger lolbin microsoft_visual_cc netsh obfuscated packed packed packer_detected pcalua squirrel threat wmic
Link:
https://www.filescan.io/uploads/689b4ada397fd3ce6fa62e28/reports/9484c929-df8b-4134-b1b8-429256bea0dc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5d67af2e-b5aa-4e45-a2d8-1a124eeb1b1d
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692/
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-07-18 07:43:11 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
31 of 38 (81.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ykvx4xu4iohvb4uhs4g6dkvjsnovqhdxe6hwxejjjjl4elic2ja._file
Verdict:
malicious
Label(s):
autoit
Create hunting rule
darkcloudstealer
Create hunting rule
Similar samples:
0db5f6cf0d7354324d546d25916af4404b5bacbab04cae8898a7a99fce90952c
a310Logger
210668bbd638108c2cecd71abfa86146b2c35f3b87478e48646a8c55f49d69d6
a310Logger
75c3aafd46fa2b87455298c7b0ff91edb13729553077af151689979448aa0434
a310Logger
ad38b8b5e1f032f090d59765c566fe3cb06fa70b77ee90f9b4a19d5ccafa8003
a310Logger
ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692
a310Logger
error
a310Logger
+ 2'681 additional samples on MalwareBazaar
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud defense_evasion discovery spyware stealer
Link:
https://tria.ge/reports/250812-rertka1ky5/
Behaviour
Kills process with taskkill
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
DarkCloud
Darkcloud family
Malware Config
C2 Extraction:
https://api.telegram.org/bot6852270017:AAFOVJ2m_OJ-xvJdXcOoP2hDLMCTR_prUiU/sendMessage?chat_id=6683518699
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e9cedfa5-690a-49e0-b37a-8c37bc05c8d2
Unpacked files
SH256 hash:
ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692
MD5 hash:
2d74d33bd6378e4a37a0baa651349b47
SHA1 hash:
5a7bdc3476d04397529e1ffcc09ceca3b349e6d0
Link:
https://www.unpac.me/results/aba68d98-86ce-49c8-ba35-91c7bc0d6fea/
SH256 hash:
c5ffb65de0523371dd6344433ea9fd056a27855dc38d7240e5d25453504e1a3f
MD5 hash:
a9f9ba4f3bb55a771e66d9dcd8202c5a
SHA1 hash:
e09e8576f2106f28f8e1562f8ce869614238806b
Detections:
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/aba68d98-86ce-49c8-ba35-91c7bc0d6fea/
Parent samples :
4eb5bc1c99ed6c8d62fee78451c21aa83418a95171dc596765af1a35ed69d10a
0db5f6cf0d7354324d546d25916af4404b5bacbab04cae8898a7a99fce90952c
ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/aba68d98-86ce-49c8-ba35-91c7bc0d6fea/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee155bf2f4e21c7a87943cb86f0d554c9aeac0e3b93c7b5c894a52be11681692

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing credit card regular expressions
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_A310Logger
Create hunting rule
Author:ditekSHen
Description:Detects A310Logger
Rule name:MALWARE_Win_DarkCloud
Create hunting rule
Author:ditekSHen
Description:Detects DarkCloud infostealer
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_DarkCloud_9905abce
Create hunting rule
Author:Elastic Security
Rule name:YahLover
Create hunting rule
Author:Kevin Falcoz
Description:YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20408/

Comments