MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00b229de51c409d79b0084465543c9197f797d4a835290ebf72cbce75cfb2044. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DBatLoader

Vendor detections: 15

Intelligence 15 IOCs YARA 12 File information Comments

SHA256 hash:	00b229de51c409d79b0084465543c9197f797d4a835290ebf72cbce75cfb2044
SHA3-384 hash:	5a24f3d0f2ee79e771a6258500e86834df5952f7cf2a63cffde5c2b81260f183280a20855439c1f9dc196b836452d129
SHA1 hash:	c168978862aa0a8d00c7f9b359dc5e8059ac7844
MD5 hash:	05ef4ca659965c1d3faa58077b0f9943
humanhash:	autumn-november-nine-fifteen
File name:	hkcmd.exe
Download:	download sample
Signature	DBatLoader Create hunting rule
File size:	1'705'472 bytes
First seen:	2025-04-14 21:13:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5260d10005ff55667f5ba84b94641d84 (1 x MassLogger, 1 x DBatLoader)
ssdeep	24576:P7c2dFfsDO896pbDZtUe0KId0nGw5FlPDtNX8KVevJyMYrOoyV:P0i9H/0r0Gw5nOJb/o
TLSH	T1E6852577615F71A2C0BDCDBC0A8A86B80CF56E3C19EC5406FDB33B0A9AE6501E4E5257
TrID	35.3% (.EXE) InstallShield setup (43053/19/16) 34.0% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 11.6% (.EXE) Win32 Executable Delphi generic (14182/79/4) 8.6% (.EXE) Win64 Executable (generic) (10522/11/4) 3.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	c46b2b072313f4ec (5 x RemcosRAT, 1 x MassLogger, 1 x DBatLoader)
Reporter	skocherhan
Tags:	192-3-26-143 DBatLoader exe opendir

skocherhan

http://192.3.26.143/440/hkcmd.exe

Intelligence

File Origin

# of uploads :

# of downloads :

506

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

hkcmd.exe

Verdict:

Malicious activity

Analysis date:

2025-04-14 21:15:01 UTC

Tags:

delphi dbatloader loader

Link:

https://app.any.run/tasks/247d0012-9a84-40fc-890a-b937c58106a3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/2219/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67fd7b711dba888a93d3dc89

Tags:

delphi emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

Creating a file

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a process from a recently created file

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context borland_delphi fingerprint keylogger modiloader packed packed packer_detected zusy

Link:

https://www.filescan.io/uploads/67fd7aa189fec6b88b9cce92/reports/d482a110-407a-4de6-9677-5ea4832b1455/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/00b229de51c409d79b0084465543c9197f797d4a835290ebf72cbce75cfb2044

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/196c1d8f-9325-4bda-94f5-6ef5ebd554c2

Result

Threat name:

DBatLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1664905

Signature

Allocates many large memory junks

Allocates memory in foreign processes

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Yara detected DBatLoader

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/00b229de51c409d79b0084465543c9197f797d4a835290ebf72cbce75cfb2044

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/00b229de51c409d79b0084465543c9197f797d4a835290ebf72cbce75cfb2044/

Threat name:

Win32.Trojan.ModiLoader

Status:

Malicious

First seen:

2025-04-09 22:37:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aczctxsryqe5pgyaqrdfkq6jdf7xs7kkqnjjb27xfs6ooxh3ebca._file

Verdict:

malicious

Label(s):

dbatloader

Similar samples:

error

DBatLoader

Result

Malware family:

modiloader

Score:

10/10

Tags:

family:modiloader discovery trojan

Link:

https://tria.ge/reports/250414-z3b21s1nx6/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Executes dropped EXE

ModiLoader Second Stage

ModiLoader, DBatLoader

Modiloader family

Verdict:

Malicious

Tags:

Win.Trojan.Modiloader-10042434-0

YARA:

n/a

Link:

https://app.threat.zone/submission/fbb8befe-2f62-4667-9494-8d98f8551e26

Unpacked files

SH256 hash:

00b229de51c409d79b0084465543c9197f797d4a835290ebf72cbce75cfb2044

MD5 hash:

05ef4ca659965c1d3faa58077b0f9943

SHA1 hash:

c168978862aa0a8d00c7f9b359dc5e8059ac7844

Link:

https://www.unpac.me/results/83bb3483-d216-4db2-b87e-6aeaf0bac833/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/00b229de51c4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/00b229de51c409d79b0084465543c9197f797d4a835290ebf72cbce75cfb2044

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Typical_Malware_String_Transforms Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Typical_Malware_String_Transforms_RID3473 Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Windows_Generic_Threat_d7b57912 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Formbook

xls 02012f3527b46baed9e595d59da675526cfba16c96e38c41cc3659e4557d9cf1

DBatLoader

exe 00b229de51c409d79b0084465543c9197f797d4a835290ebf72cbce75cfb2044

(this sample)

Dropped by

SHA256 02012f3527b46baed9e595d59da675526cfba16c96e38c41cc3659e4557d9cf1

Cape

https://www.capesandbox.com/analysis/2219/

URLhaus

https://urlhaus.abuse.ch/url/3511933/

Delivery method

Distributed via web download

Dropped by

MD5 c9686171da0995fa5db1b39456f4ca98

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::PeekMessageW user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample