MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7928558b2678795dd26448541e6e7cb0f9f5ffae38ac425b0607d4f0c7b9015e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DBatLoader
Vendor detections: 10
| SHA256 hash: | 7928558b2678795dd26448541e6e7cb0f9f5ffae38ac425b0607d4f0c7b9015e |
|---|---|
| SHA3-384 hash: | 1909f8bab24b162eca44624c0ceb8f2c7d7e352d0529daa17583909ea8f2dab9b1ce3f6d4d9cff6aaf11ceb72ba99e8b |
| SHA1 hash: | f76903b60e7e7612b350f1f9421a74f16d2c7af2 |
| MD5 hash: | 2623f5074f38cbcea5fd36ad523ed21b |
| humanhash: | william-black-spaghetti-alpha |
| File name: | Uyljxgntczjzqsjbfhyebvyzaflytpubrw.exe |
| Download: | download sample |
| Signature | DBatLoader |
| File size: | 938'496 bytes |
| First seen: | 2022-08-05 10:21:29 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3794287758e044f06cfce35b938befbc (3 x DBatLoader) |
| ssdeep | 12288:gYQP8ZYngzFyjIxOHYeOc7L7xI7kW3WnYEHyW+Kdnt:gJEZdzFycIHpOc7JIYWm1SPK5 |
| Threatray | 118 similar samples on MalwareBazaar |
| TLSH | T10E15AE62E2925833D1731B398D2B6BB49936BD113D11A94A2BF63D9C4F3A3407837397 |
| TrID | 40.4% (.EXE) InstallShield setup (43053/19/16) 13.3% (.EXE) Win32 Executable Delphi generic (14182/79/4) 12.3% (.SCR) Windows screen saver (13101/52/3) 9.8% (.EXE) Win64 Executable (generic) (10523/12/4) 9.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2) |
| File icon (PE): |  |
| dhash icon | ccdc96879e88acf4 (4 x DBatLoader, 3 x AveMariaRAT, 3 x Formbook) |
| Reporter |  lowmal3 |
| Tags: | DBatLoader exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
297
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Uyljxgntczjzqsjbfhyebvyzaflytpubrw.exe
Verdict:
Malicious activity
Analysis date:
2022-08-05 10:23:03 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckScreenResolution
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
keylogger packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
DBatLoader
Detection:
malicious
Classification:
troj.expl
Score:
72 / 100
Signature
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Yara detected UAC Bypass using ComputerDefaults
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Tnega
Status:
Malicious
First seen:
2022-08-05 10:22:10 UTC
File Type:
PE (Exe)
Extracted files:
46
AV detection:
19 of 26 (73.08%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 108 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Program crash
Unpacked files
SH256 hash:
8b9f09fe72951ae925e3c49acae22cd737fbe718fab5d3597d63ec637d7441aa
MD5 hash:
95dcf194b0df2e29399507c4b7bb0aac
SHA1 hash:
e0078138248cc9feb21f403120ad657b0ab5f61d
SH256 hash:
ed7b6166fe62ee01c6d7c16a3db3f18126c15fc9e68aac48a8d5518727b8c0c1
MD5 hash:
97565e75f5289710c75fff1e0bc50169
SHA1 hash:
6e17d6a7c57fa9e4db3a70643b5cbaf18cc444a6
SH256 hash:
7928558b2678795dd26448541e6e7cb0f9f5ffae38ac425b0607d4f0c7b9015e
MD5 hash:
2623f5074f38cbcea5fd36ad523ed21b
SHA1 hash:
f76903b60e7e7612b350f1f9421a74f16d2c7af2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.