MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613
SHA3-384 hash: 81c5b427e4c5ea10151ec38a6a9f93eae6291513e4c37d9b3eedf0065bc2108fa095abedea5fa39e1b2dffd44f1a68bb
SHA1 hash: dc17bf82ddd688e93af709465a171cc275dc6ba1
MD5 hash: 721f31a2cfa45743fbbe5d65d907a254
humanhash: don-item-beer-stairway
File name:bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:98'816 bytes
First seen:2022-04-09 17:49:19 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 8331ba190f70b8ab48d8f745c7e8bc5a (1 x DBatLoader)
ssdeep 3072:ZwOEiQcnIAFcob3nehRzsoS43ySNlg5PhMWOyko3:ZwOEiTtFTbeY7pCyk
Threatray 540 similar samples on MalwareBazaar
TLSH T125A34A23B6C584B6D13A59BC8C06B7DAB93AB9303D182577B7E80F494E3D2C1A46C5C7
Reporter P_Harish_K
Tags:DBatLoader dll exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
280
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/262339/
Detection(s):
Win.Malware.Zusy-9942194-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware zusy
Link:
https://www.filescan.io/uploads/6251c74c04b81dabe2696f4e/reports/5a023e54-aa03-42fe-b6e2-41a7920c903b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a2d425ef-3c90-4f4d-b033-0dc5dadc7538
Result
Threat name:
DBatLoader
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/973807
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Yara detected DBatLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 606294 Sample: ffzad1j48K.exe Startdate: 09/04/2022 Architecture: WINDOWS Score: 72 13 Antivirus / Scanner detection for submitted sample 2->13 15 Multi AV Scanner detection for submitted file 2->15 17 Yara detected DBatLoader 2->17 19 2 other signatures 2->19 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        process5 11 rundll32.exe 9->11         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2022-04-09 17:50:09 UTC
File Type:
PE (Dll)
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
09be7801c1d01256f48f6c72beb080dc5947487b3e54260a2d5b16ad127e5091
DBatLoader
0f93f8bfa92a0387d3076d636200ce5a4f474a1bfaf591d17c40111816c4de8b
DBatLoader
5f079a7612eb05e8574d8604154ea233b8da905cc59ba6fbaa4485c99fc2933e
DBatLoader
6a4b5aab71a352d6ae6140f99a28b0c38df78a8985b3383f1bc424ca74e046fe
DBatLoader
74d2b78e8ac7268cf8c0c1b97aa0ea37fde7945cd1867587f3c9de7a898d7f74
DBatLoader
79655e0deb2223be705fe64c7abde57e3d815e70a28ad51cae43703641e4c543
DBatLoader
f677570815857242b83340d50410dfbc9da7d77b87dff3ce887b0cf47b16095e
DBatLoader
faa817223ef389f3ee864d27cf1ec44f2c09b51686b0957cd344fe18e5144635
DBatLoader
+ 530 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader trojan
Link:
https://tria.ge/reports/220409-weksgafegp/
Behaviour
Suspicious use of WriteProcessMemory
ModiLoader First Stage
ModiLoader, DBatLoader
Unpacked files
SH256 hash:
bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613
MD5 hash:
721f31a2cfa45743fbbe5d65d907a254
SHA1 hash:
dc17bf82ddd688e93af709465a171cc275dc6ba1
Detections:
win_dbatloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/e56c1b0e-2821-4cdb-a598-1e6ec0c56152/
Parent samples :
40901dc70e02ccd60768da1dcb23556f9ab77cafd4bb074fba8440eb0470af21
89e2525019ea9d8e1050f42c57a2e4b54880c1ab929d69f8a5242dbe805c3e86
2c269830f25ce16896147da503148a0f223f79d05f27875e5beafbaba56cbf59
6a4b5aab71a352d6ae6140f99a28b0c38df78a8985b3383f1bc424ca74e046fe
af555bcf9af4d6cc249e3b6b14d73d61175bf9be40a57ce025b7b791e1c0186f
68b6c1ad6ae1afdd0ef585a7cc8f7072c7bc5ac95a1e5fd4a6389e8cc238d832
689b1874118f825772a1a032d8d4c119009e927b132638303256344b4896311e
79655e0deb2223be705fe64c7abde57e3d815e70a28ad51cae43703641e4c543
485d4ce29c089e745e40fb7690bcca17e733ff126a602992eefcd59c47c10f95
694f9f8f9d78da1cb5eeea8b7ea8257b12f8d1c1216125610437f2b0c89e7881
32f62f812e0b22d8227fd1cc681eae6f4484e94bef2d4abbfea0342a62a4e34b
882adac4b90bbb61698ae0056c7fc82a185f9b3e33f9ebbdb77bb20bcd16d41e
0d6135fd347e16b6257d853b329b335e0d3685625ef96a07241adc3e5ceeea91
b25132e9a9216fe583418ed48b0c8bacd0b5de58be6456a0c47a42cc5038bb29
aa5d2a0b371efb331119271dcbfcf4d8451ce1a4b87c786f6676a5234fd9c450
240b38b6a0a93427bad076df4c7ad9b1faf707f428fc74a31568af670103b8c6
3ce133222e75c154a06fbc81d2c85307ad5a4d843fa0ec322018a9061e489c5d
38dcf8f5d97d63180c107bc7ab5e00d0a23a589f8210c26ee6523ae0cd76a6ef
bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bc5eab9035807d258b611c670dbc460e72b99b22c65bc13dde5e3a2c4c8c9613

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/262339/

Comments