MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf
SHA3-384 hash: 52079c896da9bfaed270d217983ae4e285915f8e30b1685e3dae93c55cdb507d03bd818dc1805f35c5aca211d9be5cf9
SHA1 hash: 6f5fae0195ed36d495031572388cc7c9a995025a
MD5 hash: 7bce077ee1c38d57bea2ea47b358f2c1
humanhash: wyoming-sierra-bluebird-fourteen
File name:Scanned Document.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'342'464 bytes
First seen:2024-08-29 09:26:56 UTC
Last seen:2024-09-10 10:53:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5faae8ff15155ab8458161fbe501fca8 (1 x Formbook, 1 x DBatLoader)
ssdeep 24576:7OVUtQcs67m2R3FL5YCJv0lWeF2uk6AMskY/m2AIvO4+UVBAlUz:7OkzhjHLh6ApqI/4
Threatray 13 similar samples on MalwareBazaar
TLSH T103550691E1E04433C93115FBB787A3D47A1F7BA15A1E65C1A2BE2B340E35E882415FBB
TrID 38.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
28.2% (.EXE) Win64 Executable (generic) (10523/12/4)
12.0% (.EXE) Win32 Executable (generic) (4504/4/1)
5.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
5.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon d89838989adce474 (4 x DBatLoader, 2 x Formbook, 1 x RemcosRAT)
Reporter abuse_ch
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
381
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Scanned Document.rar
Verdict:
Malicious activity
Analysis date:
2024-08-28 05:51:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fa4ac9b9-35b3-41f8-95c2-54fe2aef70f5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Siggen29.30940.30005.12766.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d03eeafe69a9e56049d4f0
Tags:
Execution Generic Network Static Stealth Nekark
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a process from a recently created file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
borland_delphi fingerprint keylogger packed
Link:
https://www.filescan.io/uploads/66d03eea5959a837dd124301/reports/dbb0a9ba-bc40-4389-aa84-3cf5ceb58ab6/overview
Verdict:
Malicious
Labled as:
Ser.Jaik.Generic
Link:
https://www.hybrid-analysis.com/sample/b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/264b63e7-2233-40f7-af8a-3c1df7f13415
Result
Threat name:
DBatLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1501061
Signature
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Drops or copies cmd.exe with a different name (likely to bypass HIPS)
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Writes to foreign memory regions
Yara detected DBatLoader
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1501061 Sample: Scanned Document.exe Startdate: 29/08/2024 Architecture: WINDOWS Score: 100 33 onedrive.live.com 2->33 35 mkc8tw.bn.files.1drv.com 2->35 37 4 other IPs or domains 2->37 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 8 other signatures 2->53 8 Scanned Document.exe 4 2->8         started        signatures3 process4 dnsIp5 39 dual-spov-0006.spov-msedge.net 13.107.139.11, 443, 49730, 49731 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 8->39 31 C:\Users\Public\Libraries\glxrnteX.cmd, DOS 8->31 dropped 55 Writes to foreign memory regions 8->55 57 Allocates memory in foreign processes 8->57 59 Creates a thread in another existing process (thread injection) 8->59 61 Injects a PE file into a foreign processes 8->61 13 cmd.exe 1 8->13         started        15 SndVol.exe 8->15         started        file6 signatures7 process8 process9 17 esentutl.exe 2 13->17         started        21 esentutl.exe 2 13->21         started        23 conhost.exe 13->23         started        25 alpha.pif 2 13->25         started        file10 27 C:\Users\Public\alpha.pif, PE32 17->27 dropped 41 Drops PE files to the user root directory 17->41 43 Drops PE files with a suspicious file extension 17->43 45 Drops or copies cmd.exe with a different name (likely to bypass HIPS) 17->45 29 C:\Users\Public\xpha.pif, PE32 21->29 dropped signatures11
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf/
Threat name:
Win32.Trojan.ModiLoader
Create hunting rule
Status:
Malicious
First seen:
2024-08-27 19:11:45 UTC
File Type:
PE (Exe)
Extracted files:
70
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w7a7rktwslmof55cugdp6oyjpi4qxwomnwghjk6hms7j6xmjus7q._file
Verdict:
malicious
Similar samples:
28a42f4606cc7e3f5acb4c516a5728f1d29ccf0a75d619e5e77279d8a4738cae
DBatLoader
31a7e70deb8af07d7b76b5dea8cbf90ec63bea24bffdd5ebac6f223c02f55753
DBatLoader
3db983f5bbefb35bdcda7168bd4c17b5d2766a2997c1e67941a8244bc8399b94
DBatLoader
5944d6afb5b917de44033f3c301d1adcea6107552fd8c2658b567d30d86d7b70
DBatLoader
8f66087a136da4cc49c15eec3b25f784077bb2fb1f8b583765a6f0236fbe71fc
DBatLoader
9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7
DBatLoader
b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf
DBatLoader
cdf4b7a712d127e76cb563adcdc03a65abb78b7b2b7078db9eed046a9120384d
DBatLoader
+ 3 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader discovery trojan
Link:
https://tria.ge/reports/240829-leq95swgkm/
Behaviour
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Executes dropped EXE
Loads dropped DLL
ModiLoader Second Stage
ModiLoader, DBatLoader
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0351bb06-be64-4807-9d8e-9eb51aa6d81c
Unpacked files
SH256 hash:
816fa51676b2a8092f6b99c54f68cedfad591aff08f5d67696f82d6d7dca6219
MD5 hash:
39a8e85ca23b6de98ff7aeaab4e8896e
SHA1 hash:
7534a8d2f5d5e550bea625caf361306d516c16a4
Detections:
Typical_Malware_String_Transforms
Create hunting rule
Link:
https://www.unpac.me/results/82ae68bc-08ab-4c39-bba2-a3d9f0219cfb/
Parent samples :
d9fa5a32ffadff0527ca655025366ff697118e20647bfd73fe3670934a02c985
b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf
1ef76a2d8261360325fb2881c01e8cb3c1ac8cd4616cddf762e14e89e0a88d7f
964ed7e43cc6386b44ec0fc938fef97489780e9ca5262084d752a61fdafa5976
SH256 hash:
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 hash:
c116d3604ceafe7057d77ff27552c215
SHA1 hash:
452b14432fb5758b46f2897aeccd89f7c82a727d
Link:
https://www.unpac.me/results/82ae68bc-08ab-4c39-bba2-a3d9f0219cfb/
SH256 hash:
b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf
MD5 hash:
7bce077ee1c38d57bea2ea47b358f2c1
SHA1 hash:
6f5fae0195ed36d495031572388cc7c9a995025a
Detections:
DbatLoaderStage1
Create hunting rule
Link:
https://www.unpac.me/results/82ae68bc-08ab-4c39-bba2-a3d9f0219cfb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b7c1f8aa7692/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DBatLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b7c1f8aa7692d8e2f7a2a186ff3b097a390bd9cc6d8c74abc764be9f5d89a4bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::PeekMessageW
user32.dll::CreateWindowExA

Comments