MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

a310Logger

Vendor detections: 13

Intelligence 13 IOCs YARA 12 File information Comments

SHA256 hash:	f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d
SHA3-384 hash:	ba9d2e05aba62c7e1485de2b9ccd6003bbd02fbe295e004237b730433d2fc6a350a0e552eb344498d023d1c86ac82ee5
SHA1 hash:	c804280b95e5fc511dccb212bd7460c67e1d49e4
MD5 hash:	e24b25c84054ee3d3185835ee154d474
humanhash:	kilo-maine-alabama-mockingbird
File name:	f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d
Download:	download sample
Signature	a310Logger Create hunting rule
File size:	994'304 bytes
First seen:	2025-07-07 14:17:00 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:9r9CBLbAeaUL3Gd7cXAlQd68Olh2e5VaPzHXnlWqbJqqfI79:9r9OAdUXQudKlh2e5MzHXlWqdqq8
Threatray	1'191 similar samples on MalwareBazaar
TLSH	T124251251A796D922E9E417F4493AD3324BB9AFCEA400D35B98FDFCEFB9103182811257
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	a310logger exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection:

A310Logger

Link:

https://www.capesandbox.com/analysis/12816/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686bd704c9eb974737676ad4

Tags:

spawn shell msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Creating a file in the %AppData% subdirectories

Reading critical registry keys

Stealing user critical data

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

krypt packed packed packer_detected vbnet

Link:

https://www.filescan.io/uploads/686bd6f690b9181d715ccf7b/reports/4040b5bd-7f29-4ab3-a5c8-7a6e42b9e387/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d

Malware family:

DarkCloud

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/02f03405-9aea-47dd-ad54-c6c512e77fd3

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable PE (Portable Executable) SOS: 0.01 Win 32 Exe x86

Link:

https://app.malva.re/file/e24b25c84054ee3d3185835ee154d474

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d/

Threat name:

ByteCode-MSIL.Trojan.VIPKeylogger

Status:

Malicious

First seen:

2025-06-19 03:36:46 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6gx2wm764vsmq6rbgdign2kb6t5f43hpl2jwra2amptr66j2gu6q._file

Verdict:

malicious

Label(s):

unc_loader_037

darkcloudstealer

a310Logger

35bef5e9ce90087beef7cedaced82461cce0fd2571cb2d4d174a582939d9fde4

a310Logger

a04a0223a2cb079868f34225df1953d8897690ef0fd730f2d83a8dfa9515d874

a310Logger

c396d4ff2505f5f79cb995e79aa69faeac8166ea0ad107f9872ff5c837ab915c

a310Logger

+ 1'181 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/250707-rlwfbssrt4/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7c3cf2d9-05fc-4529-b76b-0e4cbac324aa

Unpacked files

SH256 hash:

f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d

MD5 hash:

e24b25c84054ee3d3185835ee154d474

SHA1 hash:

c804280b95e5fc511dccb212bd7460c67e1d49e4

Link:

https://www.unpac.me/results/4a0659f0-81bb-419c-a50f-8452b8aef5fe/

SH256 hash:

6247951f92a0c7e6ee21bae6f748be3ebea899b10ae6672eb5a971918a0b68b0

MD5 hash:

e8e4a329c82bfa27b4cfbaa23d564ed1

SHA1 hash:

009a7775bba4a18564de97e86df093fe9cd844c7

Detections:

SUSP_OBF_NET_Reactor_Indicators_Jan24

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/4a0659f0-81bb-419c-a50f-8452b8aef5fe/

Parent samples :

00f7ff43b4690c065497bdae404f265e1283d847b6e284408ae6ec73cc7dcd71
e66777ee4d792b1c933b9bff5d2777df26e5da6e3a5f2ae6e9e38e4e662644e5
9b4e541549ce7327a7fa91c7707365dec04a060b4b63b97798410658847f8c1c
e80896f3ce016957ff20d7b18f546daaead13afd31d7c8c8f94d4039b01db118
d7a183fa0b8ba92d00e0a4c046a410270618f767315a86f4019bfe26d550194a
446ac5b2673ba02db508a71c3c821a4f5b2f6d9b0f8e4af62a7b747dceae33a9
f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d
e8b879b31a0509b447b0975ee255f07ba148c0a6a90cdba08bc7172b820d35ae

SH256 hash:

00f673b599b55370d930d8343f6923864a98c0060588b85daa60efd25b49f51b

MD5 hash:

6fb0ef857f8f26103ec114d0f44290c8

SHA1 hash:

3e47f692bfd74aebfa87887a1da32e19e51395f4

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/4a0659f0-81bb-419c-a50f-8452b8aef5fe/

SH256 hash:

805f85e15a644a3b9688defc18ee2e7254e79e54fff98b9d4938d0d57757800d

MD5 hash:

9f7d7c0da383a1ff0a624b77cd5653a7

SHA1 hash:

b37554337e4eb9f7eb7b26b4658254d16e92f5b6

Detections:

MALWARE_Win_A310Logger

Link:

https://www.unpac.me/results/4a0659f0-81bb-419c-a50f-8452b8aef5fe/

Parent samples :

e5d18d2a845b927f1f7d7f7e33031a20a3d6b540e2b00f3c064255ab3948e7f0
698e5418168e5500b644766ea8c31cfc826ec6399c1f61cf85481caa3c183a65
0f421725abfeb6485909289412de00d17fafa7f2f13b4f6e439f9aaf637c2470
f1afab33fee564c87a2130d066e941f4fa5e6cef5e9368834063e71f793a353d
b782aabf9cd513691eb4b496e8d22b7f3224bf69286c7c4df7f0d29bc3a667f6

SH256 hash:

3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a

MD5 hash:

94d1531b52774dce52a89e33646d5b1d

SHA1 hash:

29bf887b025b97bd7a9e1e261852ba824234a625

Link:

https://www.unpac.me/results/4a0659f0-81bb-419c-a50f-8452b8aef5fe/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_A310Logger Create hunting rule
Author:	ditekSHen
Description:	Detects A310Logger

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	ProtectSharewareV11eCompservCMS Create hunting rule
Author:	malware-lu

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	Runtime_Broker_Variant_1 Create hunting rule
Author:	Sn0wFr0$t
Description:	Detecting malicious Runtime Broker

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	Windows_Trojan_DarkCloud_9905abce Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/12816/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_TRUST_INFO	Requires Elevated Execution (Unrestricted:true)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample