MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f702282e8b9c1edbfa3ae5b559ec40e03f0a35a897a592fb7660df5af9a2779. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 6


Intelligence 6 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f702282e8b9c1edbfa3ae5b559ec40e03f0a35a897a592fb7660df5af9a2779
SHA3-384 hash: 3dd2e39c5561c9acdd99296d1a5d027d807fb45de9496105ebdcdc7d63a8b96dec33d60f7b45e0592dc618161120af87
SHA1 hash: 69ed75eb239d335a250dd26662ed214346397ecd
MD5 hash: bfd946f6b0030e55a7bfaa36185b8439
humanhash: delta-uranus-mobile-fanta
File name:Scan Document Products Inquiry Order.xz
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'260'858 bytes
First seen:2025-10-06 10:02:20 UTC
Last seen:2025-10-09 11:45:14 UTC
File type: xz
MIME type:application/x-rar
ssdeep 24576:4jdHtB+J2jI2Q+99dfohFbxXDN4Qv9l8xfuH3S4SOJazLRck:UZGJuI2cFbxX58xEVMp
TLSH T1654533826E4725356F9B4DAECD597FCACEC1EED06E589042E149408336CBD9346383BE
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter cocaman
Tags:DBatLoader INVOICE xz


Avatar
cocaman
Malicious email (T1566.001)
From: ""Airtronics Trading, Contracting & Maintenance"
<ac@airtronicsqatar.com>" (likely spoofed)
Received: "from mail.wydawnictwoniezwykle.pl (mail.wydawnictwoniezwykle.pl [46.242.128.20]) "
Date: "Mon, 06 Oct 2025 11:01:35 +0100"
Subject: "Re: Proforma Invoice"
Attachment: "Scan Document Products Inquiry Order.xz"

Intelligence

File Origin
# of uploads :
127
# of downloads :
35
Origin country :
CH CH
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:Scan Document Products Inquiry Order.exe
File size:360'112 bytes
SHA256 hash: 4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3
MD5 hash: 0538e73fc195c3b4441721d4c60d0b96
MIME type:application/x-dosexec
Signature DBatLoader
File name:cnmpaui.dll
File size:710'656 bytes
SHA256 hash: 7dfce3a0720f43452cb6730b9fe1a4496a5ad2bf4ac6e41e37b4ad0a499f1122
MD5 hash: 363a982ff2a7239d8a6b4317883b5b83
MIME type:application/x-dosexec
Signature DBatLoader
File name:Nsyupshkxbrj
File size:830'266 bytes
SHA256 hash: b74da851006dcbcc0f69ad1b4e51744fdd1c60072da41149ab32b8cb807d8674
MD5 hash: d77374d78e2de3a7ae50b4e94ec52bf0
MIME type:application/octet-stream
Signature DBatLoader
Vendor Threat Intelligence
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e393c291bc581176cc5955
Tags:
malware
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-debug expired-cert fingerprint masquerade microsoft_visual_cc signed
Link:
https://www.filescan.io/uploads/68e393c0c74bd2958b15e85d/reports/89b63a27-b2fb-4c4b-a898-b35736be97ee/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/9f702282e8b9c1edbfa3ae5b559ec40e03f0a35a897a592fb7660df5af9a2779
Verdict:
Malicious
File Type:
rar
First seen:
2025-10-06T08:51:00Z UTC
Last seen:
2025-10-06T09:03:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9f702282e8b9c1edbfa3ae5b559ec40e03f0a35a897a592fb7660df5af9a2779/results?tab=lookup
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f702282e8b9c1edbfa3ae5b559ec40e03f0a35a897a592fb7660df5af9a2779/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-10-06 10:02:23 UTC
File Type:
Binary (Archive)
Extracted files:
66
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5ycfaxixha63p5dvznvlhwebyb7bi22rf5fsl5xmyg7ll42e54q._file
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader discovery execution persistence trojan
Link:
https://tria.ge/reports/251006-l23xfsysby/
Behaviour
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
ModiLoader Second Stage
ModiLoader, DBatLoader
Modiloader family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9f702282e8b9c1edbfa3ae5b559ec40e03f0a35a897a592fb7660df5af9a2779

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

xz 9f702282e8b9c1edbfa3ae5b559ec40e03f0a35a897a592fb7660df5af9a2779

(this sample)

DBatLoader

DLL dll 7dfce3a0720f43452cb6730b9fe1a4496a5ad2bf4ac6e41e37b4ad0a499f1122

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7dfce3a0720f43452cb6730b9fe1a4496a5ad2bf4ac6e41e37b4ad0a499f1122
  
Dropping
SHA256 b74da851006dcbcc0f69ad1b4e51744fdd1c60072da41149ab32b8cb807d8674
  
Dropping
SHA256 4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3
  
Dropping
MD5 363a982ff2a7239d8a6b4317883b5b83
  
Dropping
MD5 d77374d78e2de3a7ae50b4e94ec52bf0
  
Dropping
MD5 0538e73fc195c3b4441721d4c60d0b96
  
Dropping
DBatLoader

Comments