MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef
SHA3-384 hash: 39a5ddb5b7563671572552432407a06655ef2607079557f00c1bc4bb86baba43b291e17ba73594bef3446d4cf6fa0014
SHA1 hash: b9c7963b20fa6e834c2bddf278113dc64aead59c
MD5 hash: 106f0fc1421a9e3e481a4045fd2dd982
humanhash: early-maryland-idaho-nineteen
File name:JOB-in.line e.K. - Purchase Order - Request for Quotation 57708970.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:837'120 bytes
First seen:2022-02-21 09:06:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3bbae5474fae9ab3c9cd00f1e2cffe97 (5 x Formbook, 1 x RemcosRAT, 1 x DBatLoader)
ssdeep 24576:KW6My6w7W6VCvGC/nRiTFYvv8W01KNy/:Khc57RMQN
TLSH T112059E52B3D08936C12A12798C1BC7B8A81DBE212D549C477BEB7F4E6F393817836197
File icon (PE):PE icon
dhash icon f468cec4d4d4d4c4 (6 x Formbook, 1 x RemcosRAT, 1 x DBatLoader)
Reporter adrian__luca
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
183
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/242905/
Detection(s):
SecuriteInfo.com.Scr.MalPbsgen1.8903.28669.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/6849/overview
Behaviour
MalwareBazaar
CheckScreenResolution
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe greyware keylogger packed
Link:
https://www.filescan.io/uploads/62135643ac8ad0468b6009c4/reports/4565e910-ba68-4a41-8a35-a2a7ac9dcb69/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/92a9557e-be6f-4f5e-9bb4-e72784c3cf46
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/943107
Signature
Detected unpacking (overwrites its own PE header)
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-02-16 09:59:12 UTC
File Type:
PE (Exe)
Extracted files:
125
AV detection:
22 of 28 (78.57%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hdopr5ozpvrrqdaqppd2wxqa2crduwe7qiime3xgki5obtlwu3xq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/220221-k3bnxshgfn/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Unpacked files
SH256 hash:
bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613
MD5 hash:
721f31a2cfa45743fbbe5d65d907a254
SHA1 hash:
dc17bf82ddd688e93af709465a171cc275dc6ba1
Detections:
win_dbatloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/33e39cdb-8cc8-4663-a8e6-b6fa9998bd29/
Parent samples :
40901dc70e02ccd60768da1dcb23556f9ab77cafd4bb074fba8440eb0470af21
89e2525019ea9d8e1050f42c57a2e4b54880c1ab929d69f8a5242dbe805c3e86
2c269830f25ce16896147da503148a0f223f79d05f27875e5beafbaba56cbf59
6a4b5aab71a352d6ae6140f99a28b0c38df78a8985b3383f1bc424ca74e046fe
af555bcf9af4d6cc249e3b6b14d73d61175bf9be40a57ce025b7b791e1c0186f
68b6c1ad6ae1afdd0ef585a7cc8f7072c7bc5ac95a1e5fd4a6389e8cc238d832
689b1874118f825772a1a032d8d4c119009e927b132638303256344b4896311e
79655e0deb2223be705fe64c7abde57e3d815e70a28ad51cae43703641e4c543
485d4ce29c089e745e40fb7690bcca17e733ff126a602992eefcd59c47c10f95
694f9f8f9d78da1cb5eeea8b7ea8257b12f8d1c1216125610437f2b0c89e7881
32f62f812e0b22d8227fd1cc681eae6f4484e94bef2d4abbfea0342a62a4e34b
882adac4b90bbb61698ae0056c7fc82a185f9b3e33f9ebbdb77bb20bcd16d41e
0d6135fd347e16b6257d853b329b335e0d3685625ef96a07241adc3e5ceeea91
b25132e9a9216fe583418ed48b0c8bacd0b5de58be6456a0c47a42cc5038bb29
aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450
240b38b6a0a93427bad076df4c7ad9b1faf707f428fc74a31568af670103b8c6
3ce133222e75c154a06fbc81d2c85307ad5a4d843fa0ec322018a9061e489c5d
38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef
bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613
SH256 hash:
38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef
MD5 hash:
106f0fc1421a9e3e481a4045fd2dd982
SHA1 hash:
b9c7963b20fa6e834c2bddf278113dc64aead59c
Link:
https://www.unpac.me/results/33e39cdb-8cc8-4663-a8e6-b6fa9998bd29/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

Executable exe 38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/242905/

Comments