MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e18bfde60f96b7ea7de2182379c6c50ff90c0dcb67872498526c02b25363387. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5e18bfde60f96b7ea7de2182379c6c50ff90c0dcb67872498526c02b25363387
SHA3-384 hash:	487d6144d4c137f2629ed383b2f40d9160c5663b857f243c44976714679c2cf6d217512e877bc4078854bb6ebdb0ceee
SHA1 hash:	1cde3a1736d2b71ab0e27c0dd0fc6c9ae3bdac55
MD5 hash:	dbaa05b3c52b9b9199d48e9c3ec4b3e2
humanhash:	papa-fourteen-massachusetts-violet
File name:	niceworkingskilldevelopedwithgreatnews.hta
Download:	download sample
Signature	DBatLoader Alert Create hunting rule
File size:	14'726 bytes
First seen:	2025-03-10 19:41:19 UTC
Last seen:	2025-03-17 10:33:54 UTC
File type:	hta
MIME type:	text/html
ssdeep	96:Crjo/erj3/1oUvzCJfguhkDvrj7rjx/prjA:X+CJN
Threatray	8 similar samples on MalwareBazaar
TLSH	T16C62851E5C04EDA4AFC3B3E015EE5CCDAF2CB70B59400210B29E954693EACB944D967F
Magika	html
Reporter	abuse_ch
Tags:	192-227-228-22 DBatLoader hta

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

101

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

98.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67cf46cf1f777fe30608c899

Tags:

delphi emotet

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/5e18bfde60f96b7ea7de2182379c6c50ff90c0dcb67872498526c02b25363387/results/dashboard

Payload URLs

URL

File name

http://192.227.228.22/840/vcc.exe

HTA File

Behaviour

BlacklistAPI detected

Hybrid Analysis VBS.Asthma.2.C0CDC5FC

Verdict:

Malicious

Labled as:

VBS.Asthma.2.C0CDC5FC

Link:

https://www.hybrid-analysis.com/sample/5e18bfde60f96b7ea7de2182379c6c50ff90c0dcb67872498526c02b25363387

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox Cobalt Strike, DBatLoader, MSIL Logger,

Result

Threat name:

Cobalt Strike, DBatLoader, MSIL Logger,

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1634283

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5e18bfde60f96b7ea7de2182379c6c50ff90c0dcb67872498526c02b25363387

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5e18bfde60f96b7ea7de2182379c6c50ff90c0dcb67872498526c02b25363387/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Negasteal

Threat name:

Script-WScript.Trojan.Negasteal

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-10 03:04:15 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lyml7xta7fvx5j66egbdphdmkd7zbqg4wz4hesmfe3acwjjwgodq._file

Threatray dbatloader

Verdict:

malicious

Label(s):

dbatloader

Alert

Create hunting rule

Similar samples:

7b408a4b96dafc7827412d9e9caf5075e0fd398c58d22ea3607399f609d3a88f

DBatLoader

8c9e59f14ac46e1119c3d320ca58a41b15d7234c73409f253e06c929b683e8e5

DBatLoader

c82345d3e83948ee59b4842af218edcbc1f0cfb2ef95eae8e961731a09648f21

DBatLoader

error

DBatLoader

f8e1323fb7c77643d8bf6df30259f00bf2a6b548d532c4e0ddbf124252d792f8

DBatLoader

fa03da1f02ff38f19efbe7344740a83755b04fb3561bc61ae14e5c5ab91d01b6

DBatLoader

Hatching Triage modiloader

Result

Malware family:

modiloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:modiloader defense_evasion discovery execution trojan

Link:

https://tria.ge/reports/250310-yeqd3awxfz/

Behaviour

Modifies Internet Explorer settings

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Evasion via Device Credential Deployment

ModiLoader Second Stage

ModiLoader, DBatLoader

Modiloader family

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5e18bfde60f9/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5e18bfde60f96b7ea7de2182379c6c50ff90c0dcb67872498526c02b25363387