MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59290e0709f6bc918c12c38604eaabcd79b77f699ca2f1abf3af4fccef444a94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



DBatLoader


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments

SHA256 hash: 59290e0709f6bc918c12c38604eaabcd79b77f699ca2f1abf3af4fccef444a94
SHA3-384 hash: 68b973568a18d2e7e9411e7a6a175224a933d95d670e42dc88a8e1733a574525f6d60ae1241d95bbef58081b7fa0ed38
SHA1 hash: 705d9c59fe6cdeec9e28d1d803cb94765d1dc4de
MD5 hash: 03fb0f9df279b56130a63d5330461789
humanhash: papa-georgia-romeo-oxygen
File name:59290e0709f6bc918c12c38604eaabcd79b77f699ca2f1abf3af4fccef444a94
Download: download sample
Signature DBatLoader
File size:1'009'664 bytes
First seen:2022-08-05 13:06:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 205f6434858f3f8cc9e8b96d094507a2 (8 x DBatLoader, 4 x ModiLoader, 3 x AveMariaRAT)
ssdeep 24576:5DA1mchKTwkH17WtMBhiUDxvHiMYStUtVSn52pAf2rDNtl2aCHX:5Dhc8ZPbVI5Sn52KN
Threatray 1'689 similar samples on MalwareBazaar
TLSH T193258D32F2D24833C4B32B3C5E1B52A599397E102E74D88A6BED1D981FF96417D392C6
TrID 61.1% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
24.1% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
10.7% (.OCX) Windows ActiveX control (116521/4/18)
1.3% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.2% (.SCR) Windows screen saver (13101/52/3)
File icon (PE):PE icon
dhash icon c49af2e8ece0e6dc (8 x DBatLoader, 3 x ModiLoader, 2 x AveMariaRAT)
Reporter @adrian__luca
Tags:DBatLoader exe

Intelligence


File Origin
# of uploads :
1
# of downloads :
321
Origin country :
HU HU
Mail intelligence
No data
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
59290e0709f6bc918c12c38604eaabcd79b77f699ca2f1abf3af4fccef444a94
Verdict:
Malicious activity
Analysis date:
2022-08-05 13:03:39 UTC
Tags:
n/a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
–°reating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger obfuscated packed remcos
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
DBatLoader
Detection:
malicious
Classification:
troj
Score:
80 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Remcos
Status:
Malicious
First seen:
2022-07-30 14:55:14 UTC
File Type:
PE (Exe)
Extracted files:
44
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Unpacked files
SH256 hash:
e5cee39f56c43d207f40862077d5b015e62929ff21f9de4e45c3b958c8947770
MD5 hash:
0de7dbbda445e257c9169774b9a8000b
SHA1 hash:
23ab78a6fdd513f2b3877efc92a71fe7d44db0db
SH256 hash:
59290e0709f6bc918c12c38604eaabcd79b77f699ca2f1abf3af4fccef444a94
MD5 hash:
03fb0f9df279b56130a63d5330461789
SHA1 hash:
705d9c59fe6cdeec9e28d1d803cb94765d1dc4de

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments