MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


a310Logger


Vendor detections: 20


Intelligence 20 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33
SHA3-384 hash: 4341c93793a963de55a084690e033fdfb19f66d86c9f0d50488c22bdddccb5d611bf7a5d810bf8c6fcf4dee7f238f6b2
SHA1 hash: eb5f90d618b7ca073c212ed43d49b8ce4a87dca8
MD5 hash: d31d98de60175e1101a84bf9f2915b49
humanhash: kitten-artist-cardinal-paris
File name:Our Order Oct 12 25 AFS2 Region.pif
Download: download sample
Signature a310Logger
Create hunting rule
File size:945'664 bytes
First seen:2025-10-13 07:23:52 UTC
Last seen:2025-11-06 10:25:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:1+S17LUpXcogaOKjc8omZcaHLEMBCbBY8hul6R6:J9LUpsDdGc8omjobBnm66
TLSH T1C11512D52720EA0AD9752BFA2DB1E27003BA6DADB850D2076EC96DEB7533F004C15393
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:a310logger exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Our Order Oct 12 25 AFS2 Region.pif
Verdict:
Malicious activity
Analysis date:
2025-10-13 07:25:52 UTC
Tags:
darkcloud ims-api generic upx
Link:
https://app.any.run/tasks/d36f8fa2-1fec-45fe-a2f0-b6f0f9bcaf16

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
A310Logger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/32508/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68eca932f2ca2f143e41ed10
Tags:
malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Launching a process
Searching for the window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a file in the Windows subdirectories
Delayed writing of the file
Modifying a system file
Stealing user critical data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/68eca93311e0595e203a39f1/reports/c3f70ceb-7443-4af2-a53f-89fab1c8f98f/overview
Verdict:
Malicious
Labled as:
PasswordStealer.Genie8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-13T03:40:00Z UTC
Last seen:
2025-10-15T04:44:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan-Spy.MSIL.Noon.gen Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.DarkCloud.sb Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb Trojan-PSW.Win32.Stealer.sb
Link:
https://opentip.kaspersky.com/f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33/results?tab=lookup
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5aea3e20-bd18-4b85-9799-833ebe4570c5
Result
Threat name:
DarkCloud
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1793800
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected DarkCloud
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.48 Win 32 Exe x86
Link:
https://app.malva.re/file/d31d98de60175e1101a84bf9f2915b49
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33/
Verdict:
Malicious
Threat:
Family.DARKCLOUD
Link:
https://tip.neiki.dev/file/f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33
Threat name:
ByteCode-MSIL.Infostealer.Genie8DN
Create hunting rule
Status:
Malicious
First seen:
2025-10-13 06:40:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qdr2e5zyva3gqigvvpzxts6wtbsbu4qwpftzrblckmbwgwq54zq._file
Verdict:
malicious
Label(s):
darkcloudstealer
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
error
a310Logger
Result
Malware family:
darkcloud
Create hunting rule
Score:
  10/10
Tags:
family:darkcloud discovery spyware stealer
Link:
https://tria.ge/reports/251013-h8h9vawtfv/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
DarkCloud
Darkcloud family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8470624769:AAHCEvsJsd95yY0arpZjiMvgrZI0MgAM_g0/sendMessage?chat_id=6712961026
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f5f8ff5e-91db-4a1e-bdcf-6caa54f01ae2
Unpacked files
SH256 hash:
f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33
MD5 hash:
d31d98de60175e1101a84bf9f2915b49
SHA1 hash:
eb5f90d618b7ca073c212ed43d49b8ce4a87dca8
Link:
https://www.unpac.me/results/0cba0a6f-2902-4aa9-96ea-91c5c8fa7899/
SH256 hash:
61deef080760cdd524de3f3343f0643da19731ea34a720252c9aafd16831bd5c
MD5 hash:
42a126fd0fef2eca1df154aa00b182d9
SHA1 hash:
024fdcdab17ba26143b60212c4d8a497e397d31a
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0cba0a6f-2902-4aa9-96ea-91c5c8fa7899/
SH256 hash:
b794ed0c0c7d4499d0a2ffff67eb5b92dba83f4be7964591e9edad2755176511
MD5 hash:
2a576318d07470206dd7c45f7d896078
SHA1 hash:
3096b2a5ccd98583949a9f57842d5547b50bbc29
Link:
https://www.unpac.me/results/0cba0a6f-2902-4aa9-96ea-91c5c8fa7899/
SH256 hash:
445f5c323536da8d05f48a6c4d980c15bbacb5c73bc9b869a772b30468419435
MD5 hash:
7f591ec1e072746ca665224dd1bcb85e
SHA1 hash:
321ea6c8c6b72dea44f555248a08797b898a6404
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/0cba0a6f-2902-4aa9-96ea-91c5c8fa7899/
Parent samples :
a76551af52b38a25b869a868de5cd1b0490889c91849b9380403d78dac2c8e1d
f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33
SH256 hash:
3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a
MD5 hash:
94d1531b52774dce52a89e33646d5b1d
SHA1 hash:
29bf887b025b97bd7a9e1e261852ba824234a625
Link:
https://www.unpac.me/results/0cba0a6f-2902-4aa9-96ea-91c5c8fa7899/
Malware family:
DarkCloud
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f4071d13b9c5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.76
Link:
https://yomi.yoroi.company/submissions/f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

a310Logger

Executable exe f4071d13b9c541b34106ad5f9bce5eb4c320d390b3cb3cc42b12981b1ad0ef33

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/32508/

Comments