MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450
SHA3-384 hash: 5fc9e4c34c7e455039e5ec554c6d34f965f2024dc263493e84450bdbc071083bf80e1e62fe5e60ca698eac72d2edd491
SHA1 hash: 433ee7df7d419ecd9d52dc9e47f62c7826b37605
MD5 hash: b2c8d2414a05751f030273372df6671a
humanhash: earth-cold-south-mountain
File name:b2c8d2414a05751f030273372df6671a.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:781'824 bytes
First seen:2022-02-18 17:55:18 UTC
Last seen:2022-02-18 20:03:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash eadc597577d5e7b54bc93a32944dcb4e (3 x Formbook, 1 x AveMariaRAT, 1 x Loki)
ssdeep 12288:+ObFW7sajHjyWCAZJcM5H6xwg9cbQF0i1K2KIRD:+OJXWCAZD5wwnQ31KIN
Threatray 71 similar samples on MalwareBazaar
TLSH T104F49E52F3F18837C56B26788C9B6769981DBE013958AC472BEB2F8D0F7D25038351A7
File icon (PE):PE icon
dhash icon 903134f0e8aa55a8 (8 x Formbook, 2 x Dbatloader, 1 x BitRAT)
Reporter abuse_ch
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
299
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/242585/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader44.39626.28216.16822.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/6632/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe keylogger packed replace.exe
Link:
https://www.filescan.io/uploads/620fddb7a2660f3bb9fda4eb/reports/91044861-acc0-45f4-af33-d234a0441c18/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6e8face5-2ac1-434b-98b9-eccb3e6c4400
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/942401
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-02-18 17:56:14 UTC
File Type:
PE (Exe)
Extracted files:
99
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjosuczxd35tgeize4o4x7hu3bcrzynexb6hq33go2ssgt6zyria._file
Verdict:
malicious
Similar samples:
0d6135fd347e16b6257d853b329b335e0d3685625ef96a07241adc3e5ceeea91
DBatLoader
0f93f8bfa92a0387d3076d636200ce5a4f474a1bfaf591d17c40111816c4de8b
DBatLoader
32f62f812e0b22d8227fd1cc681eae6f4484e94bef2d4abbfea0342a62a4e34b
DBatLoader
3de53b4ea3e4c8c8522ca9fc9d38a1556cf645298b0fe18c937b0f307dba129f
DBatLoader
5f079a7612eb05e8574d8604154ea233b8da905cc59ba6fbaa4485c99fc2933e
DBatLoader
79655e0deb2223be705fe64c7abde57e3d815e70a28ad51cae43703641e4c543
DBatLoader
882adac4b90bbb61698ae0056c7fc82a185f9b3e33f9ebbdb77bb20bcd16d41e
DBatLoader
89e2525019ea9d8e1050f42c57a2e4b54880c1ab929d69f8a5242dbe805c3e86
DBatLoader
aa38c8327df5d1755de504ea0eccf988a34c786d80f0becb3e99491527289089
DBatLoader
b25132e9a9216fe583418ed48b0c8bacd0b5de58be6456a0c47a42cc5038bb29
DBatLoader
+ 61 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/220218-wh1yvscge2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Unpacked files
SH256 hash:
86d159dc4f1438f214fba765180949da457ab8fe5fb198d5090793ca9b3fc565
MD5 hash:
5cc8e484b759e664cf372b7aa9a00054
SHA1 hash:
4954df3eff6d903238cc72b657fb062540bc0e77
Link:
https://www.unpac.me/results/d588ab31-d71f-4b94-8dca-a24de48024d8/
SH256 hash:
bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613
MD5 hash:
721f31a2cfa45743fbbe5d65d907a254
SHA1 hash:
dc17bf82ddd688e93af709465a171cc275dc6ba1
Detections:
win_dbatloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/d588ab31-d71f-4b94-8dca-a24de48024d8/
Parent samples :
40901dc70e02ccd60768da1dcb23556f9ab77cafd4bb074fba8440eb0470af21
89e2525019ea9d8e1050f42c57a2e4b54880c1ab929d69f8a5242dbe805c3e86
2c269830f25ce16896147da503148a0f223f79d05f27875e5beafbaba56cbf59
6a4b5aab71a352d6ae6140f99a28b0c38df78a8985b3383f1bc424ca74e046fe
af555bcf9af4d6cc249e3b6b14d73d61175bf9be40a57ce025b7b791e1c0186f
68b6c1ad6ae1afdd0ef585a7cc8f7072c7bc5ac95a1e5fd4a6389e8cc238d832
689b1874118f825772a1a032d8d4c119009e927b132638303256344b4896311e
79655e0deb2223be705fe64c7abde57e3d815e70a28ad51cae43703641e4c543
485d4ce29c089e745e40fb7690bcca17e733ff126a602992eefcd59c47c10f95
694f9f8f9d78da1cb5eeea8b7ea8257b12f8d1c1216125610437f2b0c89e7881
32f62f812e0b22d8227fd1cc681eae6f4484e94bef2d4abbfea0342a62a4e34b
882adac4b90bbb61698ae0056c7fc82a185f9b3e33f9ebbdb77bb20bcd16d41e
0d6135fd347e16b6257d853b329b335e0d3685625ef96a07241adc3e5ceeea91
b25132e9a9216fe583418ed48b0c8bacd0b5de58be6456a0c47a42cc5038bb29
aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450
240b38b6a0a93427bad076df4c7ad9b1faf707f428fc74a31568af670103b8c6
3ce133222e75c154a06fbc81d2c85307ad5a4d843fa0ec322018a9061e489c5d
38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef
bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613
SH256 hash:
aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450
MD5 hash:
b2c8d2414a05751f030273372df6671a
SHA1 hash:
433ee7df7d419ecd9d52dc9e47f62c7826b37605
Link:
https://www.unpac.me/results/d588ab31-d71f-4b94-8dca-a24de48024d8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/aa5d2a0b371e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.50
Link:
https://yomi.yoroi.company/submissions/aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DBatLoader

Executable exe aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2040361/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/242585/

Comments