MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 309ca816bed485731d7702c80339e6b5d209618888ea92a972a7189ed1102518. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DBatLoader

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments 1

SHA256 hash:	309ca816bed485731d7702c80339e6b5d209618888ea92a972a7189ed1102518
SHA3-384 hash:	78ad7d81023201a4be8a83bd32891e39b9bd5037d6ad6cf952ca511baf1d5094f7820f6b264690b0e8d56e6c4e245e34
SHA1 hash:	ce0936c360fb9f8ea7bc961982d0e139a9c92088
MD5 hash:	b67d3b533d395332ab301841f688b04b
humanhash:	missouri-sixteen-johnny-pip
File name:	b67d3b533d395332ab301841f688b04b
Download:	download sample
Signature	DBatLoader Create hunting rule
File size:	791'040 bytes
First seen:	2021-12-09 16:18:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	cf4ac33deb94090eb70c93b194aa229d (4 x RemcosRAT, 2 x DBatLoader, 1 x Loki)
ssdeep	12288:/SYSMXRFwZEQ5TYy2apWLDcdIy7UdFRcqzit:/48wKOD2aI/Vj5G
TLSH	T101F48D6631A1D873E27781BDCC57F6E85431FB212B54E8452AD8BC0E5EF4B50F81B28A
File icon (PE):
dhash icon	e4dcd8c4d4d4c4d4 (95 x AgentTesla, 51 x Formbook, 12 x RemcosRAT)
Reporter	zbetcheckin
Tags:	32 DBatLoader exe

Intelligence

File Origin

# of uploads :

# of downloads :

182

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

PO 191753.xlsx

Verdict:

Malicious activity

Analysis date:

2021-12-08 21:31:24 UTC

Tags:

encrypted opendir exploit CVE-2017-11882 loader

Link:

https://app.any.run/tasks/3b7c1ffc-e0b2-4b67-b69e-48cccc085e9c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/212937/

Detection(s):

SecuriteInfo.com.Trojan.Siggen16.1792.10988.30659.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

DNS request

Sending a custom TCP request

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/1468/overview

Behaviour

MalwareBazaar

CheckCmdLine

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

keylogger

Link:

https://www.filescan.io/uploads/61b22c784d8e6f3a5e1c36e9/reports/b2c9d8ac-cbf2-4115-8160-053d1958319d/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9f3d2179-6637-4d0f-b681-65bebc2774f1

Result

Threat name:

DBatLoader

Detection:

malicious

Classification:

troj

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/904826

Signature

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/309ca816bed485731d7702c80339e6b5d209618888ea92a972a7189ed1102518/

Threat name:

Win32.Trojan.Delf

Status:

Malicious

First seen:

2021-12-08 17:14:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/211209-tshh6acfe4/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Unpacked files

SH256 hash:

1b7543f01e0905aad968e37baccbf702cac518496b11deecc3512c205df0dbe6

MD5 hash:

355d5d8a066c9b9296e54b6bbfa25412

SHA1 hash:

839eb5cc659aec1f09779ae374aa941bcb622b66

Detections:

win_temple_loader_w0

Link:

https://www.unpac.me/results/e79e882b-e9b9-43a5-b692-e0d5d37ab5ec/

Parent samples :

ed1d279d93f8882f951b4e4a072ca919b5d9b42b8f83da74c8ad2ceb4cf0f634
c7a89255767729cc8f5dbd610779baac706af799ccbb1a4945c55a77632e671c
af2a8024939f13bee37b6d3a35aa5df93e2a6b11cede4bea19493c4d704b050f
78900ed7307ae31ad9b74204fd8e4798b01a6b7bc593e70d4a7aaab7ab1b2b95
9936a6bda8c332e2aec071444db5f68e1b34745412158cad8394ceb3c80d36ee
016995a4b65533b314b70ebab42fb3c6dee830dff7a7261080f6e743da562b9a
34c093aa616e9e574f2ae88bc1fe3dd818200b0586ed20945147a7fb6848dfd8
8c9f7973d30b69a406f5169bf847212c11d275a96b348137c447cea3089a58a9
f6d0fdcf620ebd3b483c6dd7e9bc7bea2f9acca8d34eb7b84ebaf457671fd758
9e1f83813953f38ebc2e39ec795b85cc808e6f5cb36ea8b3a25e7eddb3cf429b
db5b52f3949ca7cb29e009535f1d2021b0f24b4e114717a20e86869abae48850
9a63e8c9e7bfb45eb903482e3ba9ed3f3d64db90b62f13355dff1a5ed5d2376d
c3e06052cbfbbf225d9d3052bb3478e1c72111d4cb18240806f32f517be86b3f
baccd3d2cd02286e08b6739dfc786f67bd64b5da6bfca6ba93ddf21f8e9d8359
9685ed86f91fd0a3c20c5badbf361475fa0316f365a35d352e8e1caff333890f
309ca816bed485731d7702c80339e6b5d209618888ea92a972a7189ed1102518
34fcac5d4cf2062249f369fda6ae1932ac41655890da91f02bc304afe3706e86
a78e89ef2769dd705ce27a6b5876ca2fdc5a5aa078ff9a4d86f186d4bb6edce8
85dca30464e5d239a82140c6611e7d9d2e4e8a7400c869c36c3c4999a0b221dc
2cbccb76adf567a82d9d6fcbf7a6c02bce157e1870df149af7391b20b9fdc672
1fc74504d626223335f39e10435bd3366bc5533619e8e7713e2a48eadd4dc26a
7cf3410e13c13eb9cdfb1fa3df95f643bfbf7b55f5de595353205b4c44b84c5d
4afefb73e99678c987858f79095a203a3df18eeeb0fe7b59571325613f4a3dd1
10f5584682c3f5d54ba1e3afd68822c81e8234531c8b1a41e11774b980915c72
b59a94fa3d43aaa64ce137a035dc166ff2226e9113decc5b24b120f0309a6c7d
b7a6d7f4d15e42eb71836dc7372f48654462c7752d015513232346f0af92f81e
1bc95ae62d31b8b9c4a34c80049f693cb31199e768af6ac4a33fe082b34209a7
8b94dbe71305cc3e5a3963757e03e6344402b9f7babb373df3d80a90e0e4d1e2
9e303489b6a886ee967ace328a26749db9664604ab638e544e260918044b21de
47576aba2a25e4b969ccd69eec27646901c41aa4d9efd6127aac9c5016568048
640fee8437e46c9ccd7ffa3b170e2bde1b5f1bcf4b13fdb5a7c67098814ff0cb
e3c4caeafd8e19662239571bd3eee795d2ffb003953ce5eb06026a1be72b32e0
be518dfc7bbd3b6b298897a86dde6242a186f613e9930f2c49f6704de37ac4a3
a90bba267082093022d3ed1685f7a9e91a2f1d384f85dc2883caecd4fd3eb505
ed063e69d7a5b6e0d14d81df38a1ec039788191dea6bd072aa573bfa90594899
764b532b622894b7ec4590c2868e0a3e0b9e58eca72251b012c6ae4c5639971f
3a7a42d1cb828cdb0f1ea382a8859052b7862414cdb3a5e2d623e922d4d00485
0fc54d55d3cb27bf5ec3c09325478deeebc49ff858fd7f413a62fb949b7a9666
2240e1501c44abd572464704dbeab4984f8d9d6811a2401b831a6255f03e6587
ef50c5943a01eb155acc81b7a4de6749ec5e438666bedc6be95f42ad92bb7c36
a3c386096f6c478045ba6190d68a6591322ec9d4e480b900d3e7ef88e1622751

SH256 hash:

309ca816bed485731d7702c80339e6b5d209618888ea92a972a7189ed1102518

MD5 hash:

b67d3b533d395332ab301841f688b04b

SHA1 hash:

ce0936c360fb9f8ea7bc961982d0e139a9c92088

Link:

https://www.unpac.me/results/e79e882b-e9b9-43a5-b692-e0d5d37ab5ec/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/309ca816bed485731d7702c80339e6b5d209618888ea92a972a7189ed1102518

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DBatLoader

exe 309ca816bed485731d7702c80339e6b5d209618888ea92a972a7189ed1102518

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1869311/

Cape

https://www.capesandbox.com/analysis/212937/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-12-09 16:18:37 UTC

url : hxxp://107.174.138.170/0001/vbc.exe