MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 16


Intelligence 16 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9
SHA3-384 hash: ec7f3e44ecbdceb48ca2acdf9f85bf2913b0adc92bffb000620a4cff3e152ad434fef98d7bcb6fffb39672256650378a
SHA1 hash: a887cd88cbf6b9262441758db842d48a7d8d8c12
MD5 hash: 9660374700b5c2eecc2efb7e2b63a3c3
humanhash: low-pizza-orange-four
File name:rDieselPlantTechnicalSheet.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'141'248 bytes
First seen:2024-09-25 12:21:49 UTC
Last seen:2024-09-25 13:57:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9acc658fb5e4e451213fe3c10cf811b3 (1 x DBatLoader)
ssdeep 24576:jkcL46wGlmCQ4dviebWBFREfuFlFnP06vtSRDZZdI39v5SPfWxtPtnwpZz2MXMGq:jQnrexf2dsjrMSehaaVt
TLSH T1E6359D1377D1B866D0B36639883EC7A3385A7D356E12F44DA2AC9E840D3826C7F69077
TrID 38.0% (.EXE) Win32 Executable Delphi generic (14182/79/4)
28.2% (.EXE) Win64 Executable (generic) (10523/12/4)
12.0% (.EXE) Win32 Executable (generic) (4504/4/1)
5.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
5.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon 74e0a49c94988894 (1 x DBatLoader)
Reporter FXOLabs
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
374
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
20092024075719092024DieselPlantTechnicalSheet.rar
Verdict:
No threats detected
Analysis date:
2024-09-20 13:15:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a1e4621c-e0a1-4dfe-a5ca-0e34b37e91ec

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Porcupine.Unclassified.269006.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f4006dc5ef4567b6c99124
Tags:
Static Stealth Modiloader Remcos Emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
borland_delphi fareit fingerprint keylogger modiloader
Link:
https://www.filescan.io/uploads/66f40075c48f81cd6a0cebfb/reports/379bc0fe-b17f-49ec-96ee-6e5c268cf20c/overview
Verdict:
Malicious
Labled as:
Trojan.GenericFCA.Agent
Link:
https://www.hybrid-analysis.com/sample/ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Dbatloader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6c4b601c-917f-407a-968b-d66d375812af
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1518224
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2024-09-19 10:08:00 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkkgzz2c6da2qaxpbnaksm7sp3lscw5oua2u67b3fcz7ocjqrouq._file
Verdict:
malicious
Label(s):
dbatloader
Create hunting rule
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader discovery trojan
Link:
https://tria.ge/reports/240925-pjwl7svdrm/
Behaviour
Script User-Agent
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
ModiLoader Second Stage
ModiLoader, DBatLoader
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2391b684-822c-4b19-b9da-cdf0f2e06681
Unpacked files
SH256 hash:
929366ecf45e2a696ebad2a8876117d6a5de670949f754224ff536d8f0c9ba10
MD5 hash:
5dee1f8079e7939dec182220773b1e20
SHA1 hash:
6c8a6eafc408b3d96aa415447e71860c72a8e3d7
Detections:
Typical_Malware_String_Transforms
Create hunting rule
Link:
https://www.unpac.me/results/98a15a63-2cb2-4fa8-a85a-3bc9853c12a4/
SH256 hash:
7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
MD5 hash:
c116d3604ceafe7057d77ff27552c215
SHA1 hash:
452b14432fb5758b46f2897aeccd89f7c82a727d
Link:
https://www.unpac.me/results/98a15a63-2cb2-4fa8-a85a-3bc9853c12a4/
SH256 hash:
0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
MD5 hash:
869640d0a3f838694ab4dfea9e2f544d
SHA1 hash:
bdc42b280446ba53624ff23f314aadb861566832
Link:
https://www.unpac.me/results/98a15a63-2cb2-4fa8-a85a-3bc9853c12a4/
SH256 hash:
ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9
MD5 hash:
9660374700b5c2eecc2efb7e2b63a3c3
SHA1 hash:
a887cd88cbf6b9262441758db842d48a7d8d8c12
Detections:
DbatLoaderStage1
Create hunting rule
Typical_Malware_String_Transforms
Create hunting rule
Link:
https://www.unpac.me/results/98a15a63-2cb2-4fa8-a85a-3bc9853c12a4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

Executable exe ba946ce742f0c1a802ef0b40a933f27ed7215baea0354f7c3b28b3f709308ba9

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::PeekMessageW
user32.dll::CreateWindowExA

Comments