MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b164a4792975654cbef62554908c3a964b4a0b73a5ae0850b5442774e51d23d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b164a4792975654cbef62554908c3a964b4a0b73a5ae0850b5442774e51d23d0
SHA3-384 hash: be656a0d170b75a478b3b5e9e29ba009fadaa9f22217834b74c5e8ac379206856c313d35b129050d160f71005bfb2094
SHA1 hash: 837898cb23b72c93ed248c37de7321be3996dd33
MD5 hash: 9b4c4e03f3acba00af1cf363b09e09fe
humanhash: louisiana-michigan-colorado-oven
File name:Yeni siparis listesi.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'064'448 bytes
First seen:2022-04-25 12:50:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d4cf2d38c8388bbe93ed7c0af7fb2d41 (3 x Formbook, 3 x DBatLoader, 2 x AveMariaRAT)
ssdeep 24576:NODWeYzvYu8Qtm12YI/vrnqpM5mxY5pIOBz:NSWNcY3tl
Threatray 12'443 similar samples on MalwareBazaar
TLSH T17A357D22EF485433D4632E785D5F57B85836BD02F92495462AF69D0CBFFA3C2382A643
TrID 40.4% (.EXE) InstallShield setup (43053/19/16)
13.3% (.EXE) Win32 Executable Delphi generic (14182/79/4)
12.3% (.SCR) Windows screen saver (13101/52/3)
9.8% (.EXE) Win64 Executable (generic) (10523/12/4)
9.3% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
File icon (PE):PE icon
dhash icon e0e4a3a6a4b8b8a8 (37 x Formbook, 9 x AZORult, 9 x Loki)
Reporter malwarelabnet
Tags:DBatLoader exe modiloader xloader

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/266348/
Detection(s):
SecuriteInfo.com.Trojan7000000f1.25929.28523.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Searching for synchronization primitives
Launching the process to change network settings
Launching cmd.exe command interpreter
Sending an HTTP GET request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe greyware keylogger replace.exe
Link:
https://www.filescan.io/uploads/6266992679c6c1e67d2ceb2b/reports/1688f08c-5556-463a-aad7-d372646a64ba/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a3fb9d4e-a0a7-4afa-967e-23d64978a540
Result
Threat name:
DBatLoader FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/982402
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Execution from Suspicious Folder
Sigma detected: Suspicious Program Location with Network Connections
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 614889 Sample: Yeni siparis listesi.exe Startdate: 25/04/2022 Architecture: WINDOWS Score: 100 49 www.aprendainglesahora.com 2->49 51 td-ccm-168-233.wixdns.net 2->51 53 gcdn0.wixdns.net 2->53 83 Found malware configuration 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 Antivirus detection for URL or domain 2->87 89 8 other signatures 2->89 11 Yeni siparis listesi.exe 1 19 2->11         started        16 Wiwpzwu.exe 16 2->16         started        signatures3 process4 dnsIp5 55 l-0003.l-dc-msedge.net 13.107.43.12, 443, 49739, 49741 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->55 57 l-0004.l-dc-msedge.net 13.107.43.13, 443, 49737, 49740 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->57 65 3 other IPs or domains 11->65 45 C:\Users\Public\Libraries\Wiwpzwu.exe, PE32 11->45 dropped 47 C:\Users\...\Wiwpzwu.exe:Zone.Identifier, ASCII 11->47 dropped 101 Writes to foreign memory regions 11->101 103 Allocates memory in foreign processes 11->103 105 Creates a thread in another existing process (thread injection) 11->105 18 DpiScaling.exe 11->18         started        59 onedrive.live.com 16->59 61 am-files.fe.1drv.com 16->61 63 07qiha.am.files.1drv.com 16->63 107 Antivirus detection for dropped file 16->107 109 Multi AV Scanner detection for dropped file 16->109 111 Injects a PE file into a foreign processes 16->111 21 logagent.exe 16->21         started        file6 signatures7 process8 signatures9 73 Modifies the context of a thread in another process (thread injection) 18->73 75 Maps a DLL or memory area into another process 18->75 77 Sample uses process hollowing technique 18->77 79 Queues an APC in another process (thread injection) 18->79 23 explorer.exe 18->23 injected 25 systray.exe 18->25         started        81 Tries to detect virtualization through RDTSC time measurements 21->81 28 cmd.exe 21->28         started        process10 signatures11 30 Wiwpzwu.exe 16 23->30         started        34 mstsc.exe 23->34         started        99 Tries to detect virtualization through RDTSC time measurements 25->99 process12 dnsIp13 67 192.168.2.1 unknown unknown 30->67 69 onedrive.live.com 30->69 71 3 other IPs or domains 30->71 113 Writes to foreign memory regions 30->113 115 Allocates memory in foreign processes 30->115 117 Creates a thread in another existing process (thread injection) 30->117 119 Injects a PE file into a foreign processes 30->119 36 DpiScaling.exe 30->36         started        121 Modifies the context of a thread in another process (thread injection) 34->121 123 Maps a DLL or memory area into another process 34->123 125 Tries to detect virtualization through RDTSC time measurements 34->125 39 cmd.exe 1 34->39         started        41 explorer.exe 1 149 34->41         started        signatures14 process15 signatures16 91 Modifies the context of a thread in another process (thread injection) 36->91 93 Maps a DLL or memory area into another process 36->93 95 Sample uses process hollowing technique 36->95 97 Tries to detect virtualization through RDTSC time measurements 39->97 43 conhost.exe 39->43         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b164a4792975654cbef62554908c3a964b4a0b73a5ae0850b5442774e51d23d0/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2022-04-24 21:47:50 UTC
File Type:
PE (Exe)
Extracted files:
46
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wfski6jjovsuzpxwevkjbdb2szfuuc3tuwxaqufviqtxjzi5epia._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
2bc652d367cd94c0eb550959e49567754d73f8eb19a485cc229ffe4caab5605d
DBatLoader
340ffaf73b1d7c0548cde151ec9acaa2afada53f3e8d6616e558d524c12b36c8
DBatLoader
3f402617d9bbe740d49a4c0e0b17e4c704a11f04ad5c708a08c5a6988e7c181f
DBatLoader
47bbde8a83ef8df67fc61f9bf6df87802e31fa8d3a15cc8efe9e3ad1ebcc6fa6
DBatLoader
5cd30e5f4506a7dc4f2cc8e0c9ce2a2061bcb3da3095c0861d88af07cbdf7f8c
DBatLoader
6d11c8f0c3968c0ad3c6d647a0d4f9d8cfec313caf002cb33217b3eee0403e4c
DBatLoader
805d05e4bc4ea60742052443cb9e2a4b3527aee8f311862ed37ec98559884555
DBatLoader
81f4e3b64cd382fe241f3ce5f0f31eafca0fc82c77c91b751d03f8eb41511b3e
DBatLoader
bcd4ff2d437acfafe367d9192ea761aa86a93f212a3a86e422650ba5820108f2
DBatLoader
+ 12'433 additional samples on MalwareBazaar
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader family:xloader campaign:uj3c loader persistence rat suricata trojan
Link:
https://tria.ge/reports/220425-p3gbmagcan/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
ModiLoader Second Stage
Xloader Payload
ModiLoader, DBatLoader
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Unpacked files
SH256 hash:
4cc5701988d394f00854412e3bf837d2152fe7889ad66311ea486749b6fe5e79
MD5 hash:
80ed5abda22d7775c401fc7a3caf0da4
SHA1 hash:
891defab576e74ab8009b4f764e9e06a1adf33b2
Detections:
win_dbatloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/5405e09a-8d6d-4727-8f7a-d9c99ad14b6b/
SH256 hash:
b164a4792975654cbef62554908c3a964b4a0b73a5ae0850b5442774e51d23d0
MD5 hash:
9b4c4e03f3acba00af1cf363b09e09fe
SHA1 hash:
837898cb23b72c93ed248c37de7321be3996dd33
Link:
https://www.unpac.me/results/5405e09a-8d6d-4727-8f7a-d9c99ad14b6b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.74
Link:
https://yomi.yoroi.company/submissions/b164a4792975654cbef62554908c3a964b4a0b73a5ae0850b5442774e51d23d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb2
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/266348/

Comments