MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dd8bf8cb0353e84983445dded6e0a42427d5adce1bae358c3cc692793530615. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



DBatLoader


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments

SHA256 hash: 3dd8bf8cb0353e84983445dded6e0a42427d5adce1bae358c3cc692793530615
SHA3-384 hash: 2cdeea55ed31b0830fd8f75d518f5b7be7fecd9137226d80823d32521b02f19d6a42717973e58a78b060e02de180c8ed
SHA1 hash: dc99e2695b030dcd66fff58e2fe1254c5ceffe21
MD5 hash: 17e836d33b139295b876b1a3b6a23299
humanhash: utah-zulu-happy-montana
File name:3dd8bf8cb0353e84983445dded6e0a42427d5adce1bae358c3cc692793530615
Download: download sample
Signature DBatLoader
File size:1'009'664 bytes
First seen:2022-08-05 09:53:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 205f6434858f3f8cc9e8b96d094507a2 (8 x DBatLoader, 4 x ModiLoader, 3 x AveMariaRAT)
ssdeep 24576:5DA1mchKTwkH17WtMBhiUDxvHiMYStUtVSn52pAf2rDNtl2aCHX:5Dhc8ZPbVI5Sn52KN
Threatray 1'669 similar samples on MalwareBazaar
TLSH T151259D21F6E24433C173377C5E5B46A59939BE103A78D88A3BE92D981FFD68178342C6
TrID 61.1% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
24.1% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
10.7% (.OCX) Windows ActiveX control (116521/4/18)
1.3% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.2% (.SCR) Windows screen saver (13101/52/3)
File icon (PE):PE icon
dhash icon c49af2e8ece0e6dc (8 x DBatLoader, 3 x ModiLoader, 2 x AveMariaRAT)
Reporter @adrian__luca
Tags:DBatLoader exe

Intelligence


File Origin
# of uploads :
1
# of downloads :
267
Origin country :
HU HU
Mail intelligence
No data
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3dd8bf8cb0353e84983445dded6e0a42427d5adce1bae358c3cc692793530615
Verdict:
Malicious activity
Analysis date:
2022-08-05 09:53:30 UTC
Tags:
n/a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
–°reating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
DBatLoader
Detection:
malicious
Classification:
troj
Score:
84 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Yara detected DBatLoader
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Remcos
Status:
Malicious
First seen:
2022-07-26 06:50:18 UTC
File Type:
PE (Exe)
Extracted files:
44
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Behaviour
Modifies system certificate store
Unpacked files
SH256 hash:
e98b5603555aa442c152eac278addd566144705643648ed09bce297cfe16a424
MD5 hash:
4c3ae14ab6238d58b05dad5245eb7cbd
SHA1 hash:
d8caba377daac2b4b0d3957e966f965f045405ac
SH256 hash:
e5cee39f56c43d207f40862077d5b015e62929ff21f9de4e45c3b958c8947770
MD5 hash:
0de7dbbda445e257c9169774b9a8000b
SHA1 hash:
23ab78a6fdd513f2b3877efc92a71fe7d44db0db
SH256 hash:
3dd8bf8cb0353e84983445dded6e0a42427d5adce1bae358c3cc692793530615
MD5 hash:
17e836d33b139295b876b1a3b6a23299
SHA1 hash:
dc99e2695b030dcd66fff58e2fe1254c5ceffe21

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments