MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

a310Logger

Vendor detections: 15

Intelligence 15 IOCs YARA 21 File information Comments

SHA256 hash:	f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c
SHA3-384 hash:	3638dc8e1e02a144351b719af05cfeb7529a0c15cb8e320f4c293902cfee99ab46b776a60cb09298b4b2384f49c93140
SHA1 hash:	9d703d00025d7c44d08e060c033094a66418eb25
MD5 hash:	cbd056fabc285664c728dad88e0e3daa
humanhash:	king-autumn-california-ack
File name:	f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c
Download:	download sample
Signature	a310Logger Create hunting rule
File size:	1'282'048 bytes
First seen:	2025-08-12 14:34:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	24576:gtb20pkaCqT5TBWgNQ7accQdWzdQ8pW75sQmLKV/l+anHSz46A:pVg5tQ7acf8CjiQvV/lLSE5
Threatray	2'721 similar samples on MalwareBazaar
TLSH	T1ED55D01273DDC365C3B25273BA25B701BEBF782506A5F96B2F98093DB920122521E773
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	adrian__luca
Tags:	a310logger exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c.exe

Verdict:

Malicious activity

Analysis date:

2025-08-12 16:19:20 UTC

Tags:

auto-startup autoit darkcloud upx ims-api generic

Link:

https://app.any.run/tasks/edcba6f8-9955-49b7-bca4-b66660ff52dd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DarkCloud

Link:

https://www.capesandbox.com/analysis/20710/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689b5441fca70bd90e8f15a3

Tags:

autorun autoit emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Creating a file

Creating a process from a recently created file

Launching a process

Sending a custom TCP request

Сreating synchronization primitives

Creating a file in the %AppData% subdirectories

Reading critical registry keys

Forced shutdown of a system process

Stealing user critical data

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit compiled-script fingerprint fingerprint hacktool keylogger microsoft_visual_cc obfuscated packed packed packer_detected threat

Link:

https://www.filescan.io/uploads/689b69659ef4d2ff7cf8bb29/reports/966a87d7-b5c8-41c8-b509-904a89683465/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/7c5b17a6-abac-4a7e-96cf-1a6118d77dd9

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c

Gathering data

Verdict:

Malicious

Threat:

Family.DARKCLOUD

Link:

https://tip.neiki.dev/file/f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-07-25 15:19:38 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7f2j3jgfr3xgh2gyfpwrqwcj6gowu5k5drwj4l25kywtrl42w6oa._file

Verdict:

malicious

Label(s):

darkcloudstealer

autoit

unc_loader_036

a310Logger

210668bbd638108c2cecd71abfa86146b2c35f3b87478e48646a8c55f49d69d6

a310Logger

5ee7ac64f54803db99273964e63d13d858c7cbe561b07393400c0cf0770815ab

a310Logger

8b3b519dac103a0437c2e78ce3f5aa64a1551739a96dd0976b4bb79bb0529d91

a310Logger

d565861451e345eee7218601370d14df9b696df6a8eeb857df9c55314a4e896b

a310Logger

+ 2'711 additional samples on MalwareBazaar

Result

Malware family:

darkcloud

Score:

10/10

Tags:

family:darkcloud discovery stealer

Link:

https://tria.ge/reports/250812-tqn8xsep8t/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

DarkCloud

Darkcloud family

Malware Config

C2 Extraction:

https://api.telegram.org/bot8006348346:AAFxBP2Fxhqr42hjwj_-WYaqfhUZomjSXEg/sendMessage?chat_id=6311012313

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/03cef98f-1a40-412b-a9fd-e9660a6ec8de

Unpacked files

SH256 hash:

f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c

MD5 hash:

cbd056fabc285664c728dad88e0e3daa

SHA1 hash:

9d703d00025d7c44d08e060c033094a66418eb25

Link:

https://www.unpac.me/results/1aeaa86b-73c0-42da-a7ca-cd98b86b83b3/

SH256 hash:

2b82b9b6d81e9c4b089f4e349ad0c2d0897e29f1781d40c5ee42add4ef5f8201

MD5 hash:

704392c897cff5fa3070217e07aff116

SHA1 hash:

e55f2ed2eba61bccd7bac22eede3748d039ca211

Detections:

darkcloudstealer

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

INDICATOR_SUSPICIOUS_EXE_CC_Regex

MALWARE_Win_A310Logger

MALWARE_Win_DarkCloud

Link:

https://www.unpac.me/results/1aeaa86b-73c0-42da-a7ca-cd98b86b83b3/

Parent samples :

31271e9208cc46f4411d2e2295ab2397dcddacff932c92423a3fbdff6ad911c4
66da637c8d8a4363d6670f7e68a73badf100fb5f6fe0229dfe5d72fd2473efef
f9749da4c58eee63e8d82bed185849f19d6a755d1c6c9e2f5d562d38af9ab79c
1849180107c4fddc3104670d0c3d0249322b49b3439d7681f6b40922806194ed

SH256 hash:

3b75425895af4ae3186b36277553641e37ca1d620ae18d68e40d13351b54de6a

MD5 hash:

94d1531b52774dce52a89e33646d5b1d

SHA1 hash:

29bf887b025b97bd7a9e1e261852ba824234a625

Link:

https://www.unpac.me/results/1aeaa86b-73c0-42da-a7ca-cd98b86b83b3/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_CC_Regex Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing credit card regular expressions

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MALWARE_Win_A310Logger Create hunting rule
Author:	ditekSHen
Description:	Detects A310Logger

Rule name:	MALWARE_Win_DarkCloud Create hunting rule
Author:	ditekSHen
Description:	Detects DarkCloud infostealer

Rule name:	ProtectSharewareV11eCompservCMS Create hunting rule
Author:	malware-lu

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	Windows_Trojan_DarkCloud_9905abce Create hunting rule
Author:	Elastic Security

Rule name:	YahLover Create hunting rule
Author:	Kevin Falcoz
Description:	YahLover

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20710/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample