MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f1f159f4bbf4affc0f19a22bf1d266ed04702ca3d3b1f0b479b4d67be301cc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f1f159f4bbf4affc0f19a22bf1d266ed04702ca3d3b1f0b479b4d67be301cc5
SHA3-384 hash: c73dd891d29802d9ff2782734c223e7548668202019d329ee632c4052ec1d51880197f568a13a966ad8056edc3141393
SHA1 hash: ad928fa24c5bc352ae8e155532bc6ba93665b5ab
MD5 hash: b4850821966f6634064e41da041c0786
humanhash: nine-india-fourteen-october
File name:Hlrzaqeuzrmikf.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'124'352 bytes
First seen:2023-10-11 19:01:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fc431a28c58a1565c388a05232b2eadb (19 x DBatLoader, 3 x RemcosRAT, 2 x Formbook)
ssdeep 12288:qE8C9kdWdEPv8zuVEdh9a6OLqvabdpmBkt1VEmA00P85Be2fgmv1qsM8HcZG3g53:qEPudPPOuVsaoAjlD0P83H5M8OG3
Threatray 53 similar samples on MalwareBazaar
TLSH T1EA355B74B3B208B1F4B97675C90A67F41DFF27EDA944288982797D1B1CB27826E1102F
TrID 74.5% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
12.2% (.EXE) InstallShield setup (43053/19/16)
4.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
3.7% (.SCR) Windows screen saver (13097/50/3)
1.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 7e3c7068e8e8e062 (28 x DBatLoader, 6 x RemcosRAT, 4 x Formbook)
Reporter abuse_ch
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
261
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Hlrzaqeuzrmikf.exe
Verdict:
Malicious activity
Analysis date:
2023-10-11 19:47:37 UTC
Tags:
dbatloader
Link:
https://app.any.run/tasks/742390d8-9024-43ea-b899-41d539162878

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
ModiLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/453392/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.15800.13402.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control keylogger lolbin
Link:
https://www.filescan.io/uploads/6526f12d853e4f064809f941/reports/ff490c9e-0e5b-4281-8027-93932cc3b7bf/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/4f1f159f4bbf4affc0f19a22bf1d266ed04702ca3d3b1f0b479b4d67be301cc5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/42860a41-8bce-4ffe-bdc5-d95781ce20d9
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1324028
Signature
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f1f159f4bbf4affc0f19a22bf1d266ed04702ca3d3b1f0b479b4d67be301cc5/
Threat name:
Win32.Trojan.ModiLoader
Create hunting rule
Status:
Malicious
First seen:
2023-10-06 00:25:46 UTC
File Type:
PE (Exe)
Extracted files:
74
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j4prlh2lx5fp7qhrtirl6hjgn3ieoawkhu5r6c2htngwpprqdtcq._file
Verdict:
malicious
Similar samples:
218b06f1a24c05c5fa1480a3c0153957800fb882d977acd28eb4d853c976fb7a
DBatLoader
240faad2172324c119d325a9396e55f0e635bac9ddf9442340439fc49fdd8bab
DBatLoader
27c3f876bb12269c818bc4c2efc8c741ca3b6b1b618f631d951e59fa62be90d5
DBatLoader
6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2
DBatLoader
846cde55897a66226b2f27e8449a44e2a43104674d4c14b2dd9a937c1d819f21
DBatLoader
8cde60f804a160f6fdaf788a4ba9a885cf178cebe4829eafbcd3fa1fb5a78185
DBatLoader
9a58cfffad0cd6dc31da5ce2d58da98c35d0e6be3461db38b78fe11692bb37a1
DBatLoader
b15a8668037928b4cc574506dc96518162693d531de044e7adf67461a123b1e5
DBatLoader
f75bcc250ddc6772d6aea9331879d102ee83b9e6b707e252d4771b02c5df9001
DBatLoader
fecb7826eb9472fa8b7a79c1029720e19f8e2deb1d2c57c8c6ebf66232ac7981
DBatLoader
+ 43 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader trojan
Link:
https://tria.ge/reports/231011-xps29sfe9z/
Behaviour
Suspicious use of WriteProcessMemory
ModiLoader Second Stage
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
4f1f159f4bbf4affc0f19a22bf1d266ed04702ca3d3b1f0b479b4d67be301cc5
MD5 hash:
b4850821966f6634064e41da041c0786
SHA1 hash:
ad928fa24c5bc352ae8e155532bc6ba93665b5ab
Link:
https://www.unpac.me/results/17d20757-bf3d-4310-befd-440456d86ec2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f1f159f4bbf4affc0f19a22bf1d266ed04702ca3d3b1f0b479b4d67be301cc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

Executable exe 4f1f159f4bbf4affc0f19a22bf1d266ed04702ca3d3b1f0b479b4d67be301cc5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/453392/

Comments