MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2
SHA3-384 hash: 4bd09d62519507fdec34bcb98f69c9c020f73b9edac70317401f715ff0b0ade9e6a23d556ec846769227aef22e4cab4c
SHA1 hash: a07bc44e9b4d2321db79e742c0ee94c22f0379df
MD5 hash: 22d3a3c2ef2230695bc95068c085439d
humanhash: diet-video-may-lithium
File name:Zdtqgygoywgcgs.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'124'352 bytes
First seen:2023-10-11 19:01:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fc431a28c58a1565c388a05232b2eadb (19 x DBatLoader, 3 x RemcosRAT, 2 x Formbook)
ssdeep 12288:qE8C9kdWdEPv8zuVEdh9a6OLqvabdpmBkt1VEmA00P85Be2fgmv1qsM8HcZG3g5I:qEPudPPOuVsaoAjlD0P83H5M8OG3
Threatray 54 similar samples on MalwareBazaar
TLSH T1B0356B70B3B60CB0F4A976B5DD0A67F40DFF27A9A9502889C279391B1CB63916F1106F
TrID 74.5% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
12.2% (.EXE) InstallShield setup (43053/19/16)
4.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
3.7% (.SCR) Windows screen saver (13097/50/3)
1.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 7e3c7068e8e8e062 (28 x DBatLoader, 6 x RemcosRAT, 4 x Formbook)
Reporter abuse_ch
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Zdtqgygoywgcgs.exe
Verdict:
Malicious activity
Analysis date:
2023-10-11 19:15:40 UTC
Tags:
dbatloader
Link:
https://app.any.run/tasks/778b13e6-c305-4971-9897-b5e1d367aa44

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
ModiLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/453391/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.21889.21242.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control keylogger lolbin
Link:
https://www.filescan.io/uploads/6526f12c8d16e62970c17ed7/reports/774762d7-392e-432d-a234-0aedecf679a5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/38921dd7-bff7-4e36-828b-ba2120457462
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1324029
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2/
Threat name:
Win32.Trojan.ModiLoader
Create hunting rule
Status:
Malicious
First seen:
2023-10-06 00:25:46 UTC
File Type:
PE (Exe)
Extracted files:
74
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nsgxqi5jlmpwjxaxr4ihpgpbwwgrajtfhbqxk5kvvr5hy7y4iwra._file
Verdict:
malicious
Similar samples:
218b06f1a24c05c5fa1480a3c0153957800fb882d977acd28eb4d853c976fb7a
DBatLoader
240faad2172324c119d325a9396e55f0e635bac9ddf9442340439fc49fdd8bab
DBatLoader
27c3f876bb12269c818bc4c2efc8c741ca3b6b1b618f631d951e59fa62be90d5
DBatLoader
4f1f159f4bbf4affc0f19a22bf1d266ed04702ca3d3b1f0b479b4d67be301cc5
DBatLoader
846cde55897a66226b2f27e8449a44e2a43104674d4c14b2dd9a937c1d819f21
DBatLoader
8cde60f804a160f6fdaf788a4ba9a885cf178cebe4829eafbcd3fa1fb5a78185
DBatLoader
9a58cfffad0cd6dc31da5ce2d58da98c35d0e6be3461db38b78fe11692bb37a1
DBatLoader
b15a8668037928b4cc574506dc96518162693d531de044e7adf67461a123b1e5
DBatLoader
f75bcc250ddc6772d6aea9331879d102ee83b9e6b707e252d4771b02c5df9001
DBatLoader
fecb7826eb9472fa8b7a79c1029720e19f8e2deb1d2c57c8c6ebf66232ac7981
DBatLoader
+ 44 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader trojan
Link:
https://tria.ge/reports/231011-xpsrhafe9y/
Behaviour
Suspicious use of WriteProcessMemory
ModiLoader Second Stage
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2
MD5 hash:
22d3a3c2ef2230695bc95068c085439d
SHA1 hash:
a07bc44e9b4d2321db79e742c0ee94c22f0379df
Link:
https://www.unpac.me/results/c2bf2d8c-9aad-42c8-b617-cb3b43de1d99/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

Executable exe 6c8d7823a95b1f64dc178f107799e1b58d1026653861757555ac7a7c7f1c45a2

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/453391/

Comments