MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1ab4430d2f436338e690327acc1869f2d0717d63093281337c33c6b99c602f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1ab4430d2f436338e690327acc1869f2d0717d63093281337c33c6b99c602f9
SHA3-384 hash: 03707811a380ea988c0057efe2295c78ccd5bb8643d54a7156cb9c47e2613e905e1b8f73c483275f80023d9ced0d386a
SHA1 hash: bf52951aeb61c56ef337e48ace9171764344a540
MD5 hash: cc0e61369a2364bb020f75a5d7f4e782
humanhash: high-quiet-kitten-april
File name:새 선적에 대한 명세서 및 송장7899999997655.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:844'800 bytes
First seen:2022-08-12 08:30:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 05a9d8c66fbf9bfc3e87bc3c4fdb70c1 (3 x DBatLoader, 1 x Formbook)
ssdeep 12288:Si7F6Nplegmje3ETxMN+lw+wZXDBehk4nSz7eIa3fo3yVqKoS:hZ6RmjeUONOkpdQk4nSzhiVqKoS
TLSH T1CC059E36B2E3E833C25E55BBEF07D574D9A57E18993CE1811BE01F6C1F71960AA18283
TrID 28.5% (.SCR) Windows screen saver (13101/52/3)
22.9% (.EXE) Win64 Executable (generic) (10523/12/4)
14.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.8% (.EXE) Win32 Executable (generic) (4505/5/1)
6.5% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
File icon (PE):PE icon
dhash icon b2b0aca6a6baf66a (4 x RemcosRAT, 4 x DBatLoader, 1 x Formbook)
Reporter TeamDreier
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
305
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
새 선적에 대한 명세서 및 송장7899999997655.exe
Verdict:
Suspicious activity
Analysis date:
2022-08-12 08:31:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/573574f7-a502-4ae1-be24-a98e94e059e5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/298191/
Detection(s):
SecuriteInfo.com.generic.ml.17586.25705.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28786/overview
Behaviour
MalwareBazaar
CheckScreenResolution
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger
Link:
https://www.filescan.io/uploads/62f61005080024921b6d0ec5/reports/2f96a76c-5fb6-4f82-9b91-46176b0bb4ae/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3499c752-65ec-4c2d-95bd-d32e864e9f7a
Result
Threat name:
DBatLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1050465
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected Remcos RAT
Yara detected UAC Bypass using ComputerDefaults
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1ab4430d2f436338e690327acc1869f2d0717d63093281337c33c6b99c602f9/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-08-12 08:31:09 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugvuimgs6q3dhdtjamt2zqmgt4wqof6wgcjsqezxym6gxgogal4q._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220812-kepkwadde6/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
6e4aba5f91f4d01295db6a25820bccf96e982c11dc19eac820ec094e8bc5b5b2
MD5 hash:
32cd4b21204a9e867088e41a0be8f6aa
SHA1 hash:
21f622535ca5ed8c0670382c420d380ba4a41799
Detections:
win_dbatloader_g1
Create hunting rule
Link:
https://www.unpac.me/results/ae58073d-441d-4029-8e3d-343d8bad3698/
Parent samples :
925e3fe8b8f4fa60dcfc261154c3fc8a6d296efcdb83ab1a18e710fa150090f1
7d5c7b03dcc7496b6dfb7f5726b3901d48da7ed3dd8e6d171db278e7ba9902b0
8043ea1eec1337542f54a3da01248f048588f43c2f5a434d425775dbb3ddd6b3
6b8b620534b94530ba467af917e0365640b83b1edd8a39eaa00ebf441e2e34c0
d09e0e3cdb3fa52dcea7852176dc97aac0741e85b22bd088fd0bf0633e3f3bbb
0454c0078d232502c16596fb561e698d11c2d68c1905d68a9578385a6a116a00
bc061c3fc38da5c64b98ca941334021a3588891eed56ba0458f5f3ca6b364081
c7046054dfa14ba59f91b14d7039a7d4bff88e62cb0b9bfaf6b3eb247662d5ce
9e58ee070798a5d3826b827e575d87746ffc1c10c1d07240263b35cf95a9f449
8b7641fa594fce9205916ac35de0c043177580e9469770f5e39adf0a72b858c4
da94505a95c11c751468743c7eb6cef882f99c6c5ad4ca0b24b4c3e36d0ea11c
e0b0ea6e18a229592ade98b150d52359b60a7169fc60952e4b5e098ce83a563a
ccf73ee5de39b84ab80990fc250259b3262abe80c2ed84c4284f78d05b0f5e4e
6a147da6ac0eec13aeaf08e385f27f58132562980c1ff628f4a4dc98ed70e202
efe38e24a3e9e5e0b6728cd3c25e36b51dee90ec0587b908a03335cf0f6757cb
3752b7276189f276a42e2ee99480c513f8a57554991644a98c7460671ec9d3c8
c830a445d79d79573e7da5f3a94fe72aa74d07fbcbb84d759915461202be06d8
bb51ea0bd2ae770fb729c3e84f1dd896e65312768893412fec620847a98cd8b5
a1ab4430d2f436338e690327acc1869f2d0717d63093281337c33c6b99c602f9
0c32394238d4d1a1865110e6f226475422a241176c28f909f114204bf9af9a92
3366a4efc3ab34464c6372c24a2d10c4919cab1d75223f4d7ab9d03299f68ed7
58bbb797b31decdd5f9d260a27fc96728c8151753b7533263f692c9ea8f0c349
4637f2930df07d5ed81ccc672ca39782c5ec2d8e77e9aba269128986a2fda5ea
81b969f8c2a9ced7707abce96338c925995da376e96841727982c59362f0eb30
SH256 hash:
a1ab4430d2f436338e690327acc1869f2d0717d63093281337c33c6b99c602f9
MD5 hash:
cc0e61369a2364bb020f75a5d7f4e782
SHA1 hash:
bf52951aeb61c56ef337e48ace9171764344a540
Link:
https://www.unpac.me/results/ae58073d-441d-4029-8e3d-343d8bad3698/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a1ab4430d2f4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1ab4430d2f436338e690327acc1869f2d0717d63093281337c33c6b99c602f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

Executable exe a1ab4430d2f436338e690327acc1869f2d0717d63093281337c33c6b99c602f9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/298191/

Comments