MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 498baff52ad2a419108074d90b6eb085afcc91ee2a881dd78aa37185779243d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 498baff52ad2a419108074d90b6eb085afcc91ee2a881dd78aa37185779243d0
SHA3-384 hash: b8c043eb6d7edc8ad28bbf1e22adec3b2446ad911e11fc44982fa61f4b1a779c4d71f001dd5b2c3df960626d27cea20e
SHA1 hash: 7b21f59f6783b0f433010b0cabe4c8d2c66328d9
MD5 hash: cd3aacfe675dfa4fccd2ccd50e52c6e7
humanhash: texas-july-lactose-papa
File name:New Product 61844-M and 61844-MA.iso
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'572'864 bytes
First seen:2022-08-03 07:02:38 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:Oeq1bWjPd8Y5Q0MFxdNLdFRlz8d52Ep8rOU:OeLValFoorx
TLSH T188758D36A2A0C437D0A32A749C0B57F89D27BE51293498463AED7E881F377613D713A7
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:DBatLoader iso


Avatar
cocaman
Malicious email (T1566.001)
From: "ali01@ever-sunrise.com" (likely spoofed)
Received: "from [141.98.6.40] (unknown [141.98.6.40]) "
Date: "2 Aug 2022 18:12:05 +0200"
Subject: "RE:RE:Additional New Product 61844-M and 61844-MA 2"
Attachment: "New Product 61844-M and 61844-MA.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PUA.UDF.EXE-1.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger packed
Link:
https://www.filescan.io/uploads/62ea1dab9ca9b9bfcbe6a7b7/reports/6734ef2a-b42d-47cb-a33f-046dafc3962e/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/498baff52ad2a419108074d90b6eb085afcc91ee2a881dd78aa37185779243d0/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2022-08-02 13:10:40 UTC
File Type:
Binary (Archive)
Extracted files:
44
AV detection:
20 of 39 (51.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jgf275jk2ksbseeaotmqw3vqqwx4zepofkeb3v4kunyyk54sipia._file
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader persistence trojan
Link:
https://tria.ge/reports/220803-hvcvxahdbp/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Enumerates connected drives
Checks computer location settings
ModiLoader Second Stage
ModiLoader, DBatLoader
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/498baff52ad2a419108074d90b6eb085afcc91ee2a881dd78aa37185779243d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

iso 498baff52ad2a419108074d90b6eb085afcc91ee2a881dd78aa37185779243d0

(this sample)

DBatLoader

Executable exe a6bc755db6d3b08decf7070cdcfc8f0d9448e7c306936bca52ea8b4cbdbacbc7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6bc755db6d3b08decf7070cdcfc8f0d9448e7c306936bca52ea8b4cbdbacbc7

Comments