MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b805f89fe412cc7df5f79a28056fb123211290c3e5ceba1b693fe600b43db1c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b805f89fe412cc7df5f79a28056fb123211290c3e5ceba1b693fe600b43db1c5
SHA3-384 hash: c7c04f9807831d5af8a5534edce1ed10c322d9c065714ae1ce367d84bbd969295d7ddfc8ab93673bebde132707c7b9ce
SHA1 hash: e3df50016d52c50d6805e5e13d0066cd6305e0d2
MD5 hash: 59f2e183925876925eeb071728049d27
humanhash: nitrogen-fix-vegan-fourteen
File name:Attachment.iso
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'441'792 bytes
First seen:2022-08-16 07:50:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:LnwbJrStO3HYk7iikpbzYoKWCfGEFziGUPJH/WF923T6wiU+S81cZki:LnCJ34PZtYoMO4WffWFcDziUS1yj
TLSH T1C1659E26E69245F7CD6316795C1B62B5E9267F003A2C74876BE93CC88F39790382F193
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:DBatLoader DHL iso


Avatar
cocaman
Malicious email (T1566.001)
From: ""DHL Express"<dhl@demandeliverys.com>" (likely spoofed)
Received: "from vmi963493.contaboserver.net (vmi963493.contaboserver.net [66.94.99.36]) "
Date: "Sat, 06 Aug 2022 16:02:24 -0700"
Subject: "DHL Delivery Attempted"
Attachment: "Attachment.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PUA.UDF.EXE-1.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger packed
Link:
https://www.filescan.io/uploads/62fb4c6b080024921b7f0741/reports/b5ce60ca-bfcf-4c25-a170-0a976140d383/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b805f89fe412cc7df5f79a28056fb123211290c3e5ceba1b693fe600b43db1c5/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-08-06 22:41:47 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xac7rh7eclgh35pxtiuak35remqrfegd4xhlug3jh7tabnb5whcq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220816-jptf5secdq/
Behaviour
Modifies system certificate store
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b805f89fe412cc7df5f79a28056fb123211290c3e5ceba1b693fe600b43db1c5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

iso b805f89fe412cc7df5f79a28056fb123211290c3e5ceba1b693fe600b43db1c5

(this sample)

DBatLoader

Executable exe b7aacc2b12e6e8f89a954e2623b6a53137257e4039ecc45311998caf6cd41cf0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b7aacc2b12e6e8f89a954e2623b6a53137257e4039ecc45311998caf6cd41cf0
  
Dropping
DBatLoader

Comments