MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd38008dce01e7bfd06e85a3bb053582a6f8a24070b0176b0906932ddc827849. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fd38008dce01e7bfd06e85a3bb053582a6f8a24070b0176b0906932ddc827849
SHA3-384 hash:	6f76b2fa3ab1404385eba4f9ad00d05ad81fd346725513a1bacbfeea42ef7b26eaf4f8b4f878d986dd31e06fb99963e6
SHA1 hash:	c029a735f8abf5dcaa3bcc1bc451068e9c764a1b
MD5 hash:	62e3408f1937719bc5f8e6e02c3f0e26
humanhash:	three-monkey-ack-thirteen
File name:	KR-Inquiry-XXXXX.tbz
Download:	download sample
Signature	a310Logger Alert Create hunting rule
File size:	866'387 bytes
First seen:	2025-12-08 14:47:31 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:38pZ+0CiqHs+yfzBSm8JjUbObhpPGeStT:38L7LqHsB1SybObCr
TLSH	T1680533E569A146B6DAF2745EE6BB7057D80374683B0090376EA21C3D5C2C0EC35AAFC3
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	a310logger rar tbz

cocaman

Malicious email (T1566.001)
From: "lyla@scatologia.com" (likely spoofed)
Received: "from truly.scatologia.com (truly.scatologia.com [94.26.68.47]) "
Date: "Mon, 08 Dec 2025 06:04:24 -0800"
Subject: "Re:New inquiry (Q8-X251014014)"
Attachment: "KR-Inquiry-XXXXX.tbz"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

23

Origin country :

CH

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/98a2aab1-ee58-430d-a3f2-8b6c669c2b8f/

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6936e555881313558a2b8717

Tags:

infosteal shell virus sage

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fd38008dce01e7bfd06e85a3bb053582a6f8a24070b0176b0906932ddc827849

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2025-12-09T04:50:00Z UTC

Last seen:

2025-12-09T05:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fd38008dce01e7bfd06e85a3bb053582a6f8a24070b0176b0906932ddc827849/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/62e3408f1937719bc5f8e6e02c3f0e26

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd38008dce01e7bfd06e85a3bb053582a6f8a24070b0176b0906932ddc827849/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.Generic

Threat name:

ByteCode-MSIL.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-12-08 15:21:17 UTC

AV detection:

15 of 37 (40.54%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7u4abdooaht37udoqwr3wbjvqktprisaocybo2yja2js3xecpbeq._file

Hatching Triage darkcloud

Result

Malware family:

darkcloud

Alert

Create hunting rule

Score:

  10/10

Tags:

family:darkcloud defense_evasion discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/251208-tqfxjseq71/

Behaviour

Kills process with taskkill

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

DarkCloud

Darkcloud family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fd38008dce01e7bfd06e85a3bb053582a6f8a24070b0176b0906932ddc827849