MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2de867d8517763734d6a3d0f73152371ea29f1523d070ba099ec9cafebacb20d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2de867d8517763734d6a3d0f73152371ea29f1523d070ba099ec9cafebacb20d
SHA3-384 hash: bbf8b9608c7d2bfd9bbda0a2227bb9b60bdbfc464534413ff2dabc2bba4de41d7e5f6a0a89392a1236b55b90407e9098
SHA1 hash: 00585e6f55a1b79c41daa40b817f5b30c8228d09
MD5 hash: f6fca49eb46335f03f799374285d16a8
humanhash: four-carolina-washington-sad
File name:PO191023-R02X56UGJ4.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'314'816 bytes
First seen:2023-10-26 07:09:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4498ed238a5d5d6510e036e3bb29986 (8 x DBatLoader, 1 x AgentTesla)
ssdeep 24576:bKuO345cRv/kabphVsJhfYPzyB+4Buxrhre0Qhd/0hkEBS/:bLysS24mwe0eMkEe
Threatray 7 similar samples on MalwareBazaar
TLSH T19555D12AF26188B1F02B0A397C27671FDB186E692964795B27FD7E540E35343386D0B3
TrID 36.1% (.SCR) Windows screen saver (13097/50/3)
29.0% (.EXE) Win64 Executable (generic) (10523/12/4)
12.4% (.EXE) Win32 Executable (generic) (4505/5/1)
5.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 2a666013d6d253ac (12 x DBatLoader, 1 x AgentTesla, 1 x RemcosRAT)
Reporter abuse_ch
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
305
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
ModiLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/456479/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.45850.23300.12710.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control keylogger lolbin packed remcos
Link:
https://www.filescan.io/uploads/653a10cdbc703e36b08e1679/reports/7d32122c-fea3-4132-ba0f-4689e3241a51/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/2de867d8517763734d6a3d0f73152371ea29f1523d070ba099ec9cafebacb20d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cdd8f473-3fcd-43fb-bd40-90d1475a2530
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1332477
Signature
Allocates many large memory junks
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2de867d8517763734d6a3d0f73152371ea29f1523d070ba099ec9cafebacb20d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2de867d8517763734d6a3d0f73152371ea29f1523d070ba099ec9cafebacb20d/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2023-10-24 04:43:01 UTC
File Type:
PE (Exe)
Extracted files:
46
AV detection:
20 of 23 (86.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fxugpwcro5rxgtlkhuhxgfjdohvct4kshudqxiez5sok725mwigq._file
Verdict:
malicious
Similar samples:
052e1b54c491c63c662fa47b08b71ba2f2c25bbb20bca619893785b87f90257d
DBatLoader
1355e7cc9be9bbd45a846e2c1bfd3f0ad58465e8e1fac10d0372ea3d8a2e8652
DBatLoader
13a14e45ca00f015b20954bfd7eed1a9eaf0a763da1d155e673e53d31821abb1
DBatLoader
5e9fb70e299a28b494b0ef9522226219e4dbf7dcf1aeae541f23eaa90ff3f28f
DBatLoader
85ca618bef7b97885f9f8c83a5abcb5afcafe9b6ffc3db6893a0dcdd61f6a891
DBatLoader
a2ccfb3d7a86abe20bf59f9e50958e1c6bb130fb80034e33555d014933245b04
DBatLoader
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader trojan
Link:
https://tria.ge/reports/231026-hzdyrseh3y/
Behaviour
Script User-Agent
Suspicious use of WriteProcessMemory
Program crash
ModiLoader Second Stage
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
9aaed649d87b5a387c65211ff13b264921448f65d6d70b98d9de3b805a161fe0
MD5 hash:
eb1469b9f6cc6cb57572455938b8c6a6
SHA1 hash:
4dd95a4ded8f7156b2a42f89eea295caaeb8047e
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/51556bf0-29b1-4cc9-aa0e-a7fecb147855/
SH256 hash:
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 hash:
c116d3604ceafe7057d77ff27552c215
SHA1 hash:
452b14432fb5758b46f2897aeccd89f7c82a727d
Link:
https://www.unpac.me/results/51556bf0-29b1-4cc9-aa0e-a7fecb147855/
SH256 hash:
2de867d8517763734d6a3d0f73152371ea29f1523d070ba099ec9cafebacb20d
MD5 hash:
f6fca49eb46335f03f799374285d16a8
SHA1 hash:
00585e6f55a1b79c41daa40b817f5b30c8228d09
Link:
https://www.unpac.me/results/51556bf0-29b1-4cc9-aa0e-a7fecb147855/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

Executable exe 2de867d8517763734d6a3d0f73152371ea29f1523d070ba099ec9cafebacb20d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/456479/

Comments