MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb4516e8454f9d4fdf43154349b28ce55350c730ea6dd247be3ee7babf5ed629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bb4516e8454f9d4fdf43154349b28ce55350c730ea6dd247be3ee7babf5ed629
SHA3-384 hash:	d33a4730c60e54f2639685a3aec5a3eb3472725c21c1659379f5252ae02d731f9611a903913c047f23c82f8d9a08c716
SHA1 hash:	4222140dc26ba9812ba98862874544c93504bcf8
MD5 hash:	60fc2ec755d8be970c6a305d28b584ce
humanhash:	table-hamper-undress-seventeen
File name:	Order Specifications for Materials.docx.vbs
Download:	download sample
Signature	DBatLoader Alert Create hunting rule
File size:	1'518'607 bytes
First seen:	2024-10-30 06:22:42 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	24576:sGpbNa5SWOiK6q89J/t3jIYOT/wqrhWSRruOEk3ot1SuP/sOllpB+uZYK3ubCC:pwJ/lkQgR6OEEoxX/ZW
TLSH	T15565CF388552FD5E3AAF49CDDC0D2DA21D702FDF82A4AB158D5E61E727C5E027A1F028
Magika	vba
Reporter	abuse_ch
Tags:	DBatLoader vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

95

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28953.VbsHeur.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6721d0db49e92a05dde1d4e1

Tags:

powershell valyria delphi emotet

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

dropper fingerprint keylogger masquerade obfuscated

Link:

https://www.filescan.io/uploads/6721d0d2d71e009bb1f844ac/reports/fda060ac-e5ed-43a2-8dfa-3471e4b98f0d/overview

Hybrid Analysis Valyria

Verdict:

Malicious

Labled as:

Valyria

Link:

https://www.hybrid-analysis.com/sample/bb4516e8454f9d4fdf43154349b28ce55350c730ea6dd247be3ee7babf5ed629

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox DBatLoader, FormBook

Result

Threat name:

DBatLoader, FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1545142

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Detected unpacking (changes PE section rights)

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Cscript/Wscript Uncommon Script Extension Execution

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Uses an obfuscated file name to hide its real file extension (double extension)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected DBatLoader

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bb4516e8454f9d4fdf43154349b28ce55350c730ea6dd247be3ee7babf5ed629

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bb4516e8454f9d4fdf43154349b28ce55350c730ea6dd247be3ee7babf5ed629/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Valyria

Threat name:

Script-WScript.Trojan.Valyria

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-10-29 14:36:28 UTC

File Type:

Text (AutoIt)

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xncrn2cfj6ou7x2dcvbutmum4vjvbrzq5jw5er56h3t3vp262yuq._file

Threatray dbatloader

Verdict:

malicious

Label(s):

dbatloader

Alert

Create hunting rule

Similar samples:

error

DBatLoader

Hatching Triage modiloader

Result

Malware family:

modiloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:modiloader discovery trojan

Link:

https://tria.ge/reports/241030-g5g2yayamc/

Behaviour

Script User-Agent

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

ModiLoader Second Stage

ModiLoader, DBatLoader

Modiloader family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.96

Link:

https://yomi.yoroi.company/submissions/bb4516e8454f9d4fdf43154349b28ce55350c730ea6dd247be3ee7babf5ed629