MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DBatLoader

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5
SHA3-384 hash:	a6ee9b5e8f248424d5dbda947820216fb591fdf794e8a965d246f4e835a269cd35aa0ad8f3df23a65fe95a1aca738c78
SHA1 hash:	d52a25f280c7ef41551c892c9a0ec4930d204afd
MD5 hash:	421e68364bf99e35f1af18e71327e994
humanhash:	yellow-ohio-yankee-carolina
File name:	421e68364bf99e35f1af18e71327e994.exe
Download:	download sample
Signature	DBatLoader Create hunting rule
File size:	1'161'216 bytes
First seen:	2025-01-14 07:23:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	44c8864bd68c3bff94639c69671ea4b7 (7 x DBatLoader)
ssdeep	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
TLSH	T19D359E3791B383F9C15289788D5FABD4A42EAD303A3CBA52FED17D0C5B252427839197
TrID	53.5% (.EXE) InstallShield setup (43053/19/16) 17.6% (.EXE) Win32 Executable Delphi generic (14182/79/4) 13.0% (.EXE) Win64 Executable (generic) (10522/11/4) 5.6% (.EXE) Win32 Executable (generic) (4504/4/1) 2.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
File icon (PE):
dhash icon	f08f898c8e8a8ff0 (7 x DBatLoader)
Reporter	abuse_ch
Tags:	DBatLoader exe

Intelligence

File Origin

# of uploads :

# of downloads :

492

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

421e68364bf99e35f1af18e71327e994.exe

Verdict:

No threats detected

Analysis date:

2025-01-14 07:29:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7afe6aed-d7a8-498e-8831-f3ebf17a9c51

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.DownLoader48.1783.27222.13667.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678611164487910100dec1fd

Tags:

delphi emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context borland_delphi fingerprint keylogger modiloader packed packed packer_detected

Link:

https://www.filescan.io/uploads/6786111aeab149d1d234059e/reports/e6a1aafb-865f-4a8f-ad85-9ed2f4ce79a6/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5d610862-5c99-45c9-9559-5a7bd1b61023

Result

Threat name:

DBatLoader

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1590520

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5/

Threat name:

Win32.Trojan.ModiLoader

Status:

Malicious

First seen:

2025-01-06 01:12:42 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kl3qvtvkzbh3dnq6pdrwup4gikdvzzssramqmbdqeqx3kmjnc3sq._file

Verdict:

malicious

Label(s):

dbatloader

Similar samples:

error

DBatLoader

Result

Malware family:

modiloader

Score:

10/10

Tags:

family:modiloader discovery trojan

Link:

https://tria.ge/reports/250114-h8ddlatjek/

Behaviour

Script User-Agent

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

ModiLoader Second Stage

ModiLoader, DBatLoader

Modiloader family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/186d9775-cdad-4aed-90a1-04103c038ebb

Unpacked files

SH256 hash:

9e1ec8ec759cddd0a535fe15822a4fc3a4dfab2f21c399492095da96cd64ca02

MD5 hash:

670e865859bf358c365498749e5dbbb9

SHA1 hash:

a0d31ce376e7c18be5a62de561e9b54bc89e29ae

Detections:

Typical_Malware_String_Transforms

Link:

https://www.unpac.me/results/12c88746-eb15-42e9-b415-404f94ff40a3/

SH256 hash:

52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5

MD5 hash:

421e68364bf99e35f1af18e71327e994

SHA1 hash:

d52a25f280c7ef41551c892c9a0ec4930d204afd

Detections:

DbatLoaderStage1

Link:

https://www.unpac.me/results/12c88746-eb15-42e9-b415-404f94ff40a3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.81

Link:

https://yomi.yoroi.company/submissions/52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DBatLoader

exe 52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3386512/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::PeekMessageW user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample