MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DBatLoader

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76
SHA3-384 hash:	38ed73801cb800bd41a590ffe00f32a567d962597837f7c57bc669f3b70f25b2f0726190417e1ad4b09abe28c8f4a60a
SHA1 hash:	a466ec15884ee1ab19dd0bed7327ffcf1db4a6f2
MD5 hash:	7e6af615a074f41ea63ef69a047e8f6d
humanhash:	chicken-november-march-cold
File name:	7e6af615a074f41ea63ef69a047e8f6d.exe
Download:	download sample
Signature	DBatLoader Create hunting rule
File size:	1'161'216 bytes
First seen:	2025-01-14 07:23:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	44c8864bd68c3bff94639c69671ea4b7 (7 x DBatLoader)
ssdeep	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
TLSH	T1D435BF7790B387FAC05689798D5FA7E4653EA830392CBA42FED17E0C5F24146B838197
TrID	53.5% (.EXE) InstallShield setup (43053/19/16) 17.6% (.EXE) Win32 Executable Delphi generic (14182/79/4) 13.0% (.EXE) Win64 Executable (generic) (10522/11/4) 5.6% (.EXE) Win32 Executable (generic) (4504/4/1) 2.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
File icon (PE):
dhash icon	f08f898c8e8a8ff0 (7 x DBatLoader)
Reporter	abuse_ch
Tags:	DBatLoader exe

Intelligence

File Origin

# of uploads :

# of downloads :

439

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

7e6af615a074f41ea63ef69a047e8f6d.exe

Verdict:

No threats detected

Analysis date:

2025-01-14 07:27:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/424a466f-90a6-49bd-af41-356c5fdc71de

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

98.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678611144487910100dec1ee

Tags:

delphi emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context borland_delphi fingerprint keylogger modiloader packed packed packer_detected

Link:

https://www.filescan.io/uploads/6786111933837f9f2abfda52/reports/5f744810-9e0b-4861-b3ee-6cf47b61d8b3/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7483ca0e-4cdf-4d56-a185-863b6269d9cd

Result

Threat name:

DBatLoader

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1590521

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76/

Threat name:

Win32.Trojan.ModiLoader

Status:

Malicious

First seen:

2025-01-06 09:30:16 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=soobewwmw3rpson4eooelu7k3e4kbqf42y6xp666chwzn3i2dr3a._file

Verdict:

malicious

Label(s):

dbatloader

Similar samples:

error

DBatLoader

Result

Malware family:

modiloader

Score:

10/10

Tags:

family:modiloader discovery trojan

Link:

https://tria.ge/reports/250114-h8ddla1mbt/

Behaviour

Script User-Agent

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

ModiLoader Second Stage

ModiLoader, DBatLoader

Modiloader family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/441bfac3-9283-4e4b-8bc5-dbd51f09836d

Unpacked files

SH256 hash:

34737a65758d2358b228577168e1e1d80925dddb8deb86c4ac7e6a4ec01ae6b3

MD5 hash:

861320205ffc34af6bc7f64d38a2bbec

SHA1 hash:

14f2e02a02b95d75578cb52b7201159a76cf4d80

Detections:

Typical_Malware_String_Transforms

Link:

https://www.unpac.me/results/a039f2a8-683e-4571-8cb9-3c89ec0e3804/

SH256 hash:

939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76

MD5 hash:

7e6af615a074f41ea63ef69a047e8f6d

SHA1 hash:

a466ec15884ee1ab19dd0bed7327ffcf1db4a6f2

Detections:

DbatLoaderStage1

Link:

https://www.unpac.me/results/a039f2a8-683e-4571-8cb9-3c89ec0e3804/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.81

Link:

https://yomi.yoroi.company/submissions/939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DBatLoader

exe 939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3378493/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::PeekMessageW user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample