MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e418cbad6006696595a396905ac73ca85eb369ca4ea3afe04619ee88468aeb50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e418cbad6006696595a396905ac73ca85eb369ca4ea3afe04619ee88468aeb50
SHA3-384 hash: ef98ee4b8af906e9dc50d9ef3685ae2784ee2ac225c4da692e59e0291889504a5ac74e8fb47d39e59125c961b9cad685
SHA1 hash: 4dfbd8c4af265224eadc59836a7f8ffebdfb598d
MD5 hash: fa9eac07d71ee997fe94012f917212a2
humanhash: virginia-echo-vermont-foxtrot
File name:DHL_SHIPMENT_NOTIFICATION_JULY_2025_73634545474_8873646467_DOCUMENT_FILE.JS
Download: download sample
Signature DBatLoader
Create hunting rule
File size:7'155'794 bytes
First seen:2025-07-16 04:12:03 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 196608:HCzChUqJ+je8h27rajU8/tjep5cej+N16QqMH18Ovxso+l+Bt:HCzChUqJ+je8h27rajUstj45cej0qMHj
Threatray 4'137 similar samples on MalwareBazaar
TLSH T12B7642C6E6F15FA0B2883F9836353B47C8DD5287EB5610F056A8D53ACA3D628C79D432
Magika javascript
Reporter abuse_ch
Tags:DBatLoader DHL js

Intelligence

File Origin
# of uploads :
1
# of downloads :
38
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=687726da3e506f63f5a40331
Tags:
emotet delphi
Verdict:
Malicious
Labled as:
JS_TrojanDropper_Agent_PRS
Link:
https://www.hybrid-analysis.com/sample/e418cbad6006696595a396905ac73ca85eb369ca4ea3afe04619ee88468aeb50
Result
Threat name:
Remcos, DBatLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1737750
Signature
Allocates many large memory junks
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Detected Remcos RAT
Early bird code injection technique detected
Found malware configuration
JavaScript source code contains functionality to generate code involving a shell, file or stream
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Remcos
Sigma detected: Suspicious Creation with Colorcpl
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected DBatLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1737750 Sample: DHL_SHIPMENT_NOTIFICATION_J... Startdate: 16/07/2025 Architecture: WINDOWS Score: 100 41 geoplugin.net 2->41 49 Suricata IDS alerts for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 14 other signatures 2->55 10 wscript.exe 1 6 2->10         started        13 Igxohmeh.exe 2->13         started        15 Igxohmeh.exe 2->15         started        signatures3 process4 signatures5 77 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->77 17 ScriptRunner.exe 3 10->17         started        79 Allocates many large memory junks 13->79 process6 process7 19 wall.css.exe 1 5 17->19         started        22 conhost.exe 17->22         started        signatures8 57 Early bird code injection technique detected 19->57 59 Allocates memory in foreign processes 19->59 61 Allocates many large memory junks 19->61 63 2 other signatures 19->63 24 colorcpl.exe 2 14 19->24         started        28 cmd.exe 3 19->28         started        30 cmd.exe 1 19->30         started        process9 dnsIp10 45 212.162.149.240, 45588, 49721 UNREAL-SERVERSUS Netherlands 24->45 47 geoplugin.net 178.237.33.50, 49722, 80 ATOM86-ASATOM86NL Netherlands 24->47 65 Detected Remcos RAT 24->65 67 Contains functionalty to change the wallpaper 24->67 69 Contains functionality to steal Chrome passwords or cookies 24->69 75 3 other signatures 24->75 71 Uses ping.exe to sleep 28->71 73 Uses ping.exe to check the status of other devices and networks 28->73 32 conhost.exe 28->32         started        34 PING.EXE 1 30->34         started        37 conhost.exe 30->37         started        39 extrac32.exe 30->39         started        signatures11 process12 dnsIp13 43 127.0.0.1 unknown unknown 34->43
Score:
92%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e418cbad6006696595a396905ac73ca85eb369ca4ea3afe04619ee88468aeb50
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e418cbad6006696595a396905ac73ca85eb369ca4ea3afe04619ee88468aeb50/
Verdict:
Malicious
Threat:
trojan
Link:
https://tip.neiki.dev/file/e418cbad6006696595a396905ac73ca85eb369ca4ea3afe04619ee88468aeb50
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-07-15 22:49:09 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4qmmxllaazuwlfnds2ifvrz4vbplg2okj2r27ycgdhxiqruk5nia._file
Verdict:
malicious
Label(s):
dbatloader
Create hunting rule
remcos
Create hunting rule
Similar samples:
3107d53f9e37c496f08e3742c379976a80f7297c192aba5b8eb7c5f29af18f33
DBatLoader
5ddc67666eea4a860efdaf22ece623349f2428fda3b39f809d6b0db61d0f2f1b
DBatLoader
70a92cdcd65bad4c5ed38adf340d5123944acde22d94c44df7ee8178f778d761
DBatLoader
c63dee86806da2bd0061973cd65f45f3a9326a42e843b5a0a5824e73ebf5916d
DBatLoader
d3078586d416311f1c8f1d03d62f3b4490c0f75d6a0177fe1076509130d59b17
DBatLoader
dcce4fcb1527dade75d9e78cd0b1c252166253ebd393c59fe613901df50ef8ec
DBatLoader
ea7950a3761e0dbcf1c6e3e2a1167ea296d7986864a35bfd260bb6c0e00f4747
DBatLoader
error
DBatLoader
+ 4'127 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Create hunting rule
Score:
  10/10
Tags:
family:modiloader defense_evasion discovery execution persistence trojan
Link:
https://tria.ge/reports/250716-ess8bssvcv/
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
System Binary Proxy Execution: ScriptRunner
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
ModiLoader Second Stage
ModiLoader, DBatLoader
Modiloader family
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/e418cbad6006696595a396905ac73ca85eb369ca4ea3afe04619ee88468aeb50

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments