MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52fa8d3fd8ba1eb0db5d259134167fd2085b0e54f1c7ba053aeab24b2b2c50af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52fa8d3fd8ba1eb0db5d259134167fd2085b0e54f1c7ba053aeab24b2b2c50af
SHA3-384 hash: b7f85bd1324e456d53ecae89d62fa0ce8fbcb1136610d722602bb8fd398cc806026458bc0a476f1591e77a5246daaad1
SHA1 hash: d69ecc91844273a4d7d113e975a04e1d8fb56f22
MD5 hash: f2902699f453b005f62027443f6c63bb
humanhash: summer-rugby-magnesium-speaker
File name:ienetstatgoodforkissing.hta
Download: download sample
Signature DBatLoader
Create hunting rule
File size:14'993 bytes
First seen:2025-03-15 08:07:28 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 96:/a5xXkne9a5KXkneHM9DPRXpfwMf/a54a5XxXkneKa5X+:/a5qe9a5leHM9r9pDHa54a5XqeKa5O
TLSH T14E6233083C287F3483E7C99149DF68E6B81C1F0B27036A94726D55614B28A70ACD97FB
Magika html
Reporter abuse_ch
Tags:DBatLoader hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d54b163962f1a6f4718d49
Tags:
delphi emotet
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/52fa8d3fd8ba1eb0db5d259134167fd2085b0e54f1c7ba053aeab24b2b2c50af/results/dashboard
Payload URLs
URL
File name
http://192.227.228.22/550/cosse.exe
HTA File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/67d5358301edd28374b084ff/reports/7bc6a382-c215-437e-828b-56a5479239bb/overview
Verdict:
Malicious
Labled as:
VBS.Asthma.2.538E03C4
Link:
https://www.hybrid-analysis.com/sample/52fa8d3fd8ba1eb0db5d259134167fd2085b0e54f1c7ba053aeab24b2b2c50af
Result
Verdict:
MALICIOUS
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Result
Threat name:
Cobalt Strike, DBatLoader, MSIL Logger,
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1639300
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Detected Cobalt Strike Beacon
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Found malware configuration
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PowerShell case anomaly found
Powershell drops PE file
Sample uses process hollowing technique
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Execution from Suspicious Folder
Sigma detected: Suspicious MSHTA Child Process
Suricata IDS alerts for network traffic
Suspicious command line found
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected MassLogger RAT
Yara detected MSIL Logger
Yara detected Powershell decode and execute
Yara detected PureLog Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1639300 Sample: ienetstatgoodforkissing.hta Startdate: 15/03/2025 Architecture: WINDOWS Score: 100 69 reallyfreegeoip.org 2->69 71 api.telegram.org 2->71 73 2 other IPs or domains 2->73 83 Suricata IDS alerts for network traffic 2->83 85 Found malware configuration 2->85 87 Malicious sample detected (through community Yara rule) 2->87 93 16 other signatures 2->93 11 mshta.exe 1 2->11         started        signatures3 89 Tries to detect the country of the analysis system (by using the IP) 69->89 91 Uses the Telegram API (likely for C&C communication) 71->91 process4 signatures5 113 Suspicious command line found 11->113 115 PowerShell case anomaly found 11->115 14 cmd.exe 1 11->14         started        process6 signatures7 117 Detected Cobalt Strike Beacon 14->117 119 Suspicious powershell command line found 14->119 121 Uses ping.exe to sleep 14->121 123 2 other signatures 14->123 17 powershell.exe 45 14->17         started        22 conhost.exe 14->22         started        process8 dnsIp9 67 192.227.228.22, 49722, 80 AS-COLOCROSSINGUS United States 17->67 55 C:\Users\user\AppData\Roaming\cosse.exe, PE32 17->55 dropped 57 C:\Users\user\AppData\Local\...\cosse[1].exe, PE32 17->57 dropped 59 C:\Users\user\AppData\...\v1gkgsnn.cmdline, Unicode 17->59 dropped 95 Loading BitLocker PowerShell Module 17->95 97 Powershell drops PE file 17->97 24 cosse.exe 6 17->24         started        28 csc.exe 3 17->28         started        file10 signatures11 process12 file13 61 C:\Users\user\Links\hxamozsK.pif, PE32 24->61 dropped 99 Drops PE files with a suspicious file extension 24->99 101 Writes to foreign memory regions 24->101 103 Allocates memory in foreign processes 24->103 105 2 other signatures 24->105 30 hxamozsK.pif 15 2 24->30         started        34 cmd.exe 1 24->34         started        36 cmd.exe 1 24->36         started        63 C:\Users\user\AppData\Local\...\v1gkgsnn.dll, PE32 28->63 dropped 38 cvtres.exe 1 28->38         started        signatures14 process15 dnsIp16 77 api.telegram.org 149.154.167.220, 443, 49732 TELEGRAMRU United Kingdom 30->77 79 checkip.dyndns.com 193.122.6.168, 49723, 80 ORACLE-BMC-31898US United States 30->79 81 reallyfreegeoip.org 104.21.112.1, 443, 49724 CLOUDFLARENETUS United States 30->81 125 Detected unpacking (changes PE section rights) 30->125 127 Detected unpacking (overwrites its own PE header) 30->127 129 Tries to steal Mail credentials (via file / registry access) 30->129 131 Tries to harvest and steal browser information (history, passwords, etc) 30->131 40 esentutl.exe 34->40         started        44 conhost.exe 34->44         started        46 alpha.pif 34->46         started        48 alpha.pif 34->48         started        133 Uses ping.exe to sleep 36->133 50 PING.EXE 36->50         started        53 conhost.exe 36->53         started        signatures17 process18 dnsIp19 65 C:\Users\Public\alpha.pif, PE32 40->65 dropped 107 Drops PE files to the user root directory 40->107 109 Drops PE files with a suspicious file extension 40->109 111 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 40->111 75 127.0.0.1 unknown unknown 50->75 file20 signatures21
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/52fa8d3fd8ba1eb0db5d259134167fd2085b0e54f1c7ba053aeab24b2b2c50af
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52fa8d3fd8ba1eb0db5d259134167fd2085b0e54f1c7ba053aeab24b2b2c50af/
Threat name:
Script-WScript.Trojan.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-03-15 08:08:10 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kl5i2p6yxiplbw25ewitift72iefwdsu6hd3ubj25kzewkzmkcxq._file
Verdict:
malicious
Label(s):
dbatloader
Create hunting rule
Similar samples:
error
DBatLoader
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader defense_evasion discovery execution trojan
Link:
https://tria.ge/reports/250315-j1msqsytcy/
Behaviour
Modifies Internet Explorer settings
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Evasion via Device Credential Deployment
ModiLoader Second Stage
ModiLoader, DBatLoader
Modiloader family
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/52fa8d3fd8ba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DBatLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52fa8d3fd8ba1eb0db5d259134167fd2085b0e54f1c7ba053aeab24b2b2c50af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DBatLoader

HTML Application (hta) hta 52fa8d3fd8ba1eb0db5d259134167fd2085b0e54f1c7ba053aeab24b2b2c50af

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3478139/
  
Delivery method
Distributed via web download

Comments