MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91b5c318543587a212464565a4df06eae2ad2823338389134f06c4409047e18e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91b5c318543587a212464565a4df06eae2ad2823338389134f06c4409047e18e
SHA3-384 hash: 17ed9a3cf326ff065608c410867a4b34673353ca2f075e386d6caa54e9ace689a1a6a06daa74b70ec5692ceadc1b5134
SHA1 hash: c1054a0a99c42a759117c7b378b213764e1b0a0d
MD5 hash: c3b7bf1f14d4359889e2233e9d3393be
humanhash: robin-twenty-jupiter-lake
File name:c3b7bf1f14d4359889e2233e9d3393be
Download: download sample
Signature DBatLoader
Create hunting rule
File size:740'864 bytes
First seen:2021-11-26 19:19:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 01f42bb56bd8196b0da3b3826e73efd5 (4 x Formbook, 1 x RemcosRAT, 1 x DBatLoader)
ssdeep 12288:HOYMYlxIimj6qr9wMiE+wGFYjA2KY59roDBM6nGplGJY:HOJYMimv+9wGqfKY59cM6GplGJ
Threatray 169 similar samples on MalwareBazaar
TLSH T100F47D13FDA37436C5062579BC5F1E24D836BF203A14D87C2AF9BC0D0E7AA826A75176
File icon (PE):PE icon
dhash icon 74f0888a8c8880b4 (5 x Formbook, 2 x RemcosRAT, 2 x DBatLoader)
Reporter zbetcheckin
Tags:32 DBatLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c3b7bf1f14d4359889e2233e9d3393be
Verdict:
Suspicious activity
Analysis date:
2021-11-26 19:23:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8c7b4dbe-b924-4957-95ad-ad7e93218b9a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Zusy.408309.14966.9919.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger packed
Link:
https://www.filescan.io/uploads/61a13368b71ceed41531ff42/reports/d323a968-6eaf-4786-9f98-dc0796f560fc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/457aa4d1-3d66-4439-aa1e-131f9df21981
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/896947
Signature
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91b5c318543587a212464565a4df06eae2ad2823338389134f06c4409047e18e/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2021-11-26 19:20:16 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
23 of 27 (85.19%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
294c51109403fa50956ad9381fea61e33d1ea7bcfe24c0631e42db5fa2258488
DBatLoader
46e51f41840a1a08e695f8b5dbd03efd3b3f7071edc00d9e916a73a02d8176a1
DBatLoader
4f88fcf537adbb598d8335dd88dba85c97ed666930084bf718502938eb75bc42
DBatLoader
5627d54b0f87a8fa0e9a33d2cbce145140eb0e88e77f1076e7658310b742aa83
DBatLoader
6b93224c145b221ac786bf10b1471af61722e45bbd41a029789170ea7f1c0751
DBatLoader
7c491171fbe25c5f47f560db3a857cfc716d0c4733466ac08660e8a8be9bc8cd
DBatLoader
b3d6d97ed4c74d16ab89046ee019d874b8cc1a8ca257e132b3d2cbd146a48545
DBatLoader
ddd5f6afb29b3c8f1f8482e1407411271f172cb589c5379bae0d9a59053480ef
DBatLoader
fb55f300cbcea6d62e33eb76a196849d1a67ce91c46255d2180fcd6a2cdc43f9
DBatLoader
+ 159 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211126-x14m5secer/
Unpacked files
SH256 hash:
80862d46bdac152572d0faa96c99edb9bcb3d5d3ff5d1d41771f5cb8ad164a2c
MD5 hash:
7c09b28f7639c8b2a033e88db5d9df53
SHA1 hash:
fbcccc3c2d024228a3e1dab743b3912ed8ccbb3c
Detections:
win_temple_loader_w0
Create hunting rule
Link:
https://www.unpac.me/results/6021b068-499e-4f9a-9b56-f52439ac6ead/
Parent samples :
e50290f9b9cf781a2d64f7e3190de28d2b673cd24099675d3b65a80ab70cf9e1
a00a856f0d85fcb7f485777ae81a0b1c52974bb1cd2482ba5e987a7ce8207511
7c491171fbe25c5f47f560db3a857cfc716d0c4733466ac08660e8a8be9bc8cd
5627d54b0f87a8fa0e9a33d2cbce145140eb0e88e77f1076e7658310b742aa83
46e51f41840a1a08e695f8b5dbd03efd3b3f7071edc00d9e916a73a02d8176a1
bc42c1e528e70d0f4152e78278ed1a0e4bacf4cab8bb21da9ea8f99a48676355
62d54d23908b06fb851da8829798a3d82110e0c189a8794f9d7deb9642f1542d
91b5c318543587a212464565a4df06eae2ad2823338389134f06c4409047e18e
57e117773ebe7caaac7d1db9759f5c8313d15db896f7b736459c65164770a5f5
6c2c4e5bb1275643184f07bd2bce3f51722e3b3e0557fbf0d83c0dc6461c4a5b
2d086daa30c03800b673011e6ee10d5ccdfa56842f67188ac348e30ed5cc803c
SH256 hash:
91b5c318543587a212464565a4df06eae2ad2823338389134f06c4409047e18e
MD5 hash:
c3b7bf1f14d4359889e2233e9d3393be
SHA1 hash:
c1054a0a99c42a759117c7b378b213764e1b0a0d
Link:
https://www.unpac.me/results/6021b068-499e-4f9a-9b56-f52439ac6ead/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/91b5c318543587a212464565a4df06eae2ad2823338389134f06c4409047e18e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DBatLoader

Executable exe 91b5c318543587a212464565a4df06eae2ad2823338389134f06c4409047e18e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1821025/

Comments


Avatar
zbet commented on 2021-11-26 19:19:21 UTC

url : hxxp://52.56.119.158/40004/we3-88.exe