MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22e4c6c1d3eb1e8a93d2b36b152ef39cff53bc933ff80153057788fadf6615db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22e4c6c1d3eb1e8a93d2b36b152ef39cff53bc933ff80153057788fadf6615db
SHA3-384 hash: 2954c55aa70eb19891d4f1d2c7a483006c62055faa02dffb6470dd4de438bd7360ba3c9a294f3badec9538ac4d8dd4b0
SHA1 hash: 2a303cff1987c7e7319246d8b8bf1d19e9e52fce
MD5 hash: ace33f06e59be4460aa6ae5e900919b8
humanhash: july-sodium-black-lemon
File name:Vfqezxwfjsmpycxhqsxglybwdivhzopzuw.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'085'952 bytes
First seen:2021-11-22 12:09:31 UTC
Last seen:2021-11-22 13:59:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 671c081df187d22f9c77c7176755651b (2 x Formbook, 1 x DBatLoader)
ssdeep 12288:dTUA/J1MeQDzBMODjUvMJNj5knUgg4lK5ltoSK/O3OmbzPVslKNU:5T/OGODjUkJNuVtKLtobOJbOlK
Threatray 864 similar samples on MalwareBazaar
TLSH T108356B25F651CF33D53F363588264288547B7D003E6297C96FEA2E10BD321857E26BAB
File icon (PE):PE icon
dhash icon 0cb23272b98ce6d1 (6 x RemcosRAT, 5 x Formbook, 2 x DBatLoader)
Reporter madjack_red
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Vfqezxwfjsmpycxhqsxglybwdivhzopzuw.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-22 12:13:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/de870885-3213-4c15-9ffb-2b176787d3b0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.LresultFromObject.25871.29443.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
exploit fareit keylogger
Link:
https://www.filescan.io/uploads/619b889fdd04e7d00e0229c2/reports/98c475bf-a223-4b5d-bcb5-177c080f6ac7/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f34cc1a-5426-4c4b-ac19-2e9ff026da67
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/893791
Signature
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22e4c6c1d3eb1e8a93d2b36b152ef39cff53bc933ff80153057788fadf6615db/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 12:10:12 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=elsmnqot5mpive6swnvrklxttt7vhpeth74acuyfo6epvx3gcxnq._file
Verdict:
malicious
Similar samples:
449c33f2127c186ec3304d4a6979831b41776c8a09357f2f572f0fd40a2732cf
DBatLoader
480f201b5183d8ddf826462569bcf719750368df95907ee93aa3fe3cd8212acf
DBatLoader
51cf8bad7a9dfffdab43a17761c29b9d1bd1004675a4e9fa6965e5430a6e371b
DBatLoader
62f36cc4ec3591ca9db78a063f6f215746f453f1181c64c0adda032ea86c53fd
DBatLoader
84c89b2859b386f60a109593eeb9068e52b10f435872d2e7abe76bffb4e9d564
DBatLoader
8968808899b3e810e675fc87e6ff0f61c82b444183fd7f8febdb276eee05e683
DBatLoader
d0d6952f4459c50159f7a9142da641df17cae7dc758c9a34bdcd19765bea37bc
DBatLoader
d544f115e860d3282bd996d7b12ac92c10097d68d135667cca0f847ca754f8ef
DBatLoader
+ 854 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211122-pb241sadf5/
Unpacked files
SH256 hash:
c0d655ca0862ee8f069564e3e7fcb17d930e0c877a31e749f4ad1b73a38e855a
MD5 hash:
7f01373693adbbd15ca15fff811a2c1a
SHA1 hash:
bf4ef40f0feaf42aeac4767ff93bfe83e1f0c89d
Detections:
win_temple_loader_w0
Create hunting rule
Link:
https://www.unpac.me/results/3c9246cb-82b1-449e-831c-7ec2a68ebe1e/
Parent samples :
bfbe11d6ffb3c82c59ac2cf85176583ff2ea5449d926584a59181286611f48f3
22e4c6c1d3eb1e8a93d2b36b152ef39cff53bc933ff80153057788fadf6615db
839d28f4d38455750ddf9ddffdd57d0cc6ee009714f407a8698e65e96eb9fa71
9bfd468b402317eb1dc711af78f4340d855cbf234a4736188283a6fa6f8d3cb2
2863a8690acd578ea41d8ef458f493c7bab50c34d8d6fd668f8ef56d429094de
41469a749da51e8aa7e1ea159041bf74f712dd4f23f076188f547ee0c0f7933f
413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d
34443c2f4cf165f96c3eaffb93f2a7b3628ebed8ed119b3ef2ad3e5dc450e0a0
fe367e5f3b5894117d3b699784bc5da3cb4083608c94879895b279b2bc2f32a4
SH256 hash:
22e4c6c1d3eb1e8a93d2b36b152ef39cff53bc933ff80153057788fadf6615db
MD5 hash:
ace33f06e59be4460aa6ae5e900919b8
SHA1 hash:
2a303cff1987c7e7319246d8b8bf1d19e9e52fce
Link:
https://www.unpac.me/results/3c9246cb-82b1-449e-831c-7ec2a68ebe1e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/22e4c6c1d3eb1e8a93d2b36b152ef39cff53bc933ff80153057788fadf6615db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:SUSP_Encoded_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/208134/

Comments