MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897
SHA3-384 hash: 56ecfcbcc15172d2e754e5678bedfa2a218b3f407755745740deedd1c5f361cc80df3f07bf9fb2b87636d1c47f2481c7
SHA1 hash: 739d43e6ab9f1b35c01e243065128eececbc59c9
MD5 hash: 479c65c47deaf7fb21cb82273ef08d73
humanhash: one-seven-river-charlie
File name:4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'605'632 bytes
First seen:2025-12-08 15:13:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 825b81cbf84889d1f9a947979d8d2e09 (8 x a310Logger, 4 x DBatLoader, 1 x MassLogger)
ssdeep 24576:is2HDXNkMW1w+cVmtncbV4KhdRPtB0uWLuXeWNLYZeUkeCQL:idM1q+miuNLYZaeXL
Threatray 13 similar samples on MalwareBazaar
TLSH T1FC75CF52B1E08532C12729355C16A3AA6529FEB42D74E84536EC3F48CFFB2A07C1AD77
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter adrian__luca
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897
Verdict:
No threats detected
Analysis date:
2025-12-08 21:49:47 UTC
Tags:
delphi
Link:
https://app.any.run/tasks/08aa3843-03d7-4d67-92d7-37b0114976d2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/43386/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.44004.22711.11198.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win32.MalwareX-gen.85585684.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936ebcbdb58e1a2c22b8f00
Tags:
delphi emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file
Creating a process from a recently created file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Malicious
Labled as:
TrojanDownloader/ModiLoader.a
Link:
https://www.hybrid-analysis.com/sample/4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-18T06:20:00Z UTC
Last seen:
2025-12-10T04:37:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e4a8d343-716d-4438-844b-54165824a3eb
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/479c65c47deaf7fb21cb82273ef08d73
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897/
Threat name:
Win32.Trojan.DBatLoader
Create hunting rule
Status:
Malicious
First seen:
2025-11-18 09:09:00 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jjrxlruva4l3wwp2rfi3fwbj7krpdttlcljoo2dk3454uf3jrclq._file
Verdict:
malicious
Label(s):
dbatloader
Create hunting rule
formbook
Create hunting rule
Similar samples:
12a45143a35ee31f3e9c92deb6377873b3aaf360aab15bd606d347bedd0a2378
DBatLoader
59c9153a4675a740e9e17934e288c5be876f37334c1ce79427c40e7e13e5cb6a
DBatLoader
5a13dd5d13e094fa6d10b545dd72855d21143c478ebb5bb589f7334767cd4d34
DBatLoader
85ad935b3f04ac7a537e4cf51894c03ed4764343f3b0d8c56657d9137d8e451e
DBatLoader
867dc4d48c2fbef423c67cf481e33703e7e6a9494a400078298494777b23b18d
DBatLoader
a5f78735653da4c3d43c54946a6a9bea1e595b66081284f965c8d73f29d65bc4
DBatLoader
b09c80681d134a2d076c491793044e8865a34acfefbc86ac8b66e739a585c5e1
DBatLoader
d551f8f0d78d6017bcd4291bc70495e45cb500402d9c45476c7af2324155a93b
DBatLoader
d9281de206f0a6ba959317eaf87ab62e6d57d9bed3a31f81308a2fea95f3a42e
DBatLoader
df7ae8cbf85a38ceab3551bf0f806fb3b6b62a2664d029c465309ffccf9f6d69
DBatLoader
error
DBatLoader
+ 3 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:formbook family:modiloader discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/251208-sl24jsxldy/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Formbook payload
ModiLoader Second Stage
Formbook
Formbook family
ModiLoader, DBatLoader
Modiloader family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fef451db-a980-46e9-b4ab-724f6a9360c8
Unpacked files
SH256 hash:
4a6375c6950717bb59fa8951b2d829faa2f1ce6b12d2e7686adf3bca17698897
MD5 hash:
479c65c47deaf7fb21cb82273ef08d73
SHA1 hash:
739d43e6ab9f1b35c01e243065128eececbc59c9
Link:
https://www.unpac.me/results/acd57be5-f427-4803-bc37-a7a3e113f787/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43386/

Comments