MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcc249e21fb278d56fcc3758f3b5f3730420688791b2195255ae8e6cc4bc5334. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcc249e21fb278d56fcc3758f3b5f3730420688791b2195255ae8e6cc4bc5334
SHA3-384 hash: 13205e8eba52c075bf1bf6a43fa948e480f9930e72495b8d88739403e78554ac95550317af27634d56e2e2b061b53b35
SHA1 hash: 4a715e4f5f84f545e18af09b3781b3b2926f2b34
MD5 hash: 1442bc371c383f75302edc99bfabdd80
humanhash: muppet-artist-oklahoma-apart
File name:transfer7422.exe
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'079'808 bytes
First seen:2022-04-09 12:58:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4116ae7b3160bb7c72cca76cb8e5eb22 (5 x Formbook, 5 x DBatLoader, 3 x ModiLoader)
ssdeep 12288:33NcL6BFE+1exrI13sasf0iLBBejqqB7WLjq716TnT0tyB3h2zZec4qOjF:3aj4eisasTBorATnT00Wzby
Threatray 570 similar samples on MalwareBazaar
TLSH T196357D22FB89A833D8321A395D0F67A455367E137D2854062AE12E5CEFF73427839793
File icon (PE):PE icon
dhash icon b2b1f1ecccce9c98 (8 x Formbook, 6 x DBatLoader, 5 x ModiLoader)
Reporter abuse_ch
Tags:DBatLoader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
293
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Approval requested-RE- transfer.eml
Verdict:
Malicious activity
Analysis date:
2022-04-07 12:14:48 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/9ce856e0-608f-475f-80de-3a9a685c0ecd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/262316/
Detection(s):
Win.Trojan.Pwsx-9943091-0
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware2.28889.30456.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/13280/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe greyware keylogger packed replace.exe
Link:
https://www.filescan.io/uploads/625183160d7cd5530a74b4d1/reports/7748ced8-e073-4e68-8908-0d2abc536b1b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b13d5623-8615-4d83-bca9-3f5c58833dce
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/973770
Signature
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fcc249e21fb278d56fcc3758f3b5f3730420688791b2195255ae8e6cc4bc5334/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-04-07 12:05:57 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7tbetyq7wj4nk36mg5mphnptomcca2ehsgzbsusvv2hgzrf4km2a._file
Verdict:
malicious
Similar samples:
03632b99b5401681e8dacf45710bfce9919f840843b836bad53c3113dacb097e
DBatLoader
2bc652d367cd94c0eb550959e49567754d73f8eb19a485cc229ffe4caab5605d
DBatLoader
3bdc8a2cdae7fb2ab12ead1f0ced298aefb6cdcd9d35e88295a71192e193d481
DBatLoader
3e25c1a249031c7ec06d4d6ad15a9dcd9f6cf0a72053663ebdd7a31eafb59c35
DBatLoader
710c03f2e039d3bde583d2fa87faa58d17cbe6655a31b1e4e7890bf9687952c5
DBatLoader
805d05e4bc4ea60742052443cb9e2a4b3527aee8f311862ed37ec98559884555
DBatLoader
afb058fdd8aa200fe754289c9b48d8876f4bbd7cbcefc964742d76c32a990340
DBatLoader
ee0e3ef0d4e024fee83ad9744a0c2fda54ea009c099144d7f3f5972b0e3c7c4d
DBatLoader
+ 560 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220409-p72s5aehdn/
Unpacked files
SH256 hash:
4f921407dc157cd3ec27cf0bfb6bba1e1b5463076526378fa65e8121288a774b
MD5 hash:
f125d9101ccc3b42b5a847f8182b85e5
SHA1 hash:
c2f18fe8876110488df97d0818e0dd3cb89b0105
Detections:
win_dbatloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/223a63bd-0f7c-44af-b159-a866115f0930/
Parent samples :
3e25c1a249031c7ec06d4d6ad15a9dcd9f6cf0a72053663ebdd7a31eafb59c35
710c03f2e039d3bde583d2fa87faa58d17cbe6655a31b1e4e7890bf9687952c5
3bdc8a2cdae7fb2ab12ead1f0ced298aefb6cdcd9d35e88295a71192e193d481
805d05e4bc4ea60742052443cb9e2a4b3527aee8f311862ed37ec98559884555
571776f9f0168eb83034055ce51c1c72d1dcc6cb10445ac4de70104f97a170ff
2bc652d367cd94c0eb550959e49567754d73f8eb19a485cc229ffe4caab5605d
afb058fdd8aa200fe754289c9b48d8876f4bbd7cbcefc964742d76c32a990340
7ac202314f674281f31bad6e38a61c4bdd54c07f14b6dfd260d0665b8f2d0fa5
4690e84717b8b884bec65eddf700c6c99cfd19ebacbeadd766f9c3088c291112
03632b99b5401681e8dacf45710bfce9919f840843b836bad53c3113dacb097e
7cb6095dfefda254e0f96c3613cddcbcff7ce50b57a78e7f369d846d222eef49
82fc93baeea70f5e1c60ea976212b5cd2a33402ede66cd0efb059eaa5fae8150
b931f34008a112398ad48f0bd4e2e955dd7385bcc5cafd41cdb2220f26bddc44
6353828ddb8f70dd9a535d3314ac328b044539563334f093173b86fd96e24707
687b7b359a5cac51eeb2d8bd04b147bdca3af96f148c2e560b3aff235d48e6b0
bea87dfd8f3d79c5948163bb57da34a9c86b798817c9e5b9c8f169175b3f2a33
27309bb8844a4d48af2527787b781fdac2917d6f75f870743428a3e7aa44fc1a
fcc249e21fb278d56fcc3758f3b5f3730420688791b2195255ae8e6cc4bc5334
a421a1405a23a9e8e3807cee8c264a3068171e19f01f3d00e318a1757024db18
ee0e3ef0d4e024fee83ad9744a0c2fda54ea009c099144d7f3f5972b0e3c7c4d
4f921407dc157cd3ec27cf0bfb6bba1e1b5463076526378fa65e8121288a774b
70784bb09d094929ecd5666ae8d5ee613c7dbee18a21b009595f0b19777f5ec5
3f402617d9bbe740d49a4c0e0b17e4c704a11f04ad5c708a08c5a6988e7c181f
c122639d652908b10751cb546a1c48e753427aa4d74f6a638fcb6c829b65e12f
5a66917ff5fd5809f0c83a8240aeb983799f54916c0f45d2f1af61de5b7741f1
ac749d4dc15be0711d85256e946a41958427a7468dc3e15f0069d3691364c45a
c130e105a03b4d144a63a8be13f6c84aa4bb01df2a566756e022e79bec487c20
6a52acf5de13a2c4d6fa927727fb868db6d97220c5eb837ca307d19c0b7cf128
9ef6b1868ca09cf927398496746dc5c1e73980fe7e3c1ffe4f45004a1f11d16b
75b7d30e6f26fbb3fbac284ed75356cc874e73365764130209d4937d80a6c80d
08c0273e2bd04a047d150303d4cd05076c2d2877afa82543ce43fc8296d86a7c
dcccbb97201914164dc8bed003f14daadfa300a6206b7ce835f6c7ee8b686405
3e755ebc4b3e451616df6473cf0f804e3c0d79e06e4f7bd54f94544848961f12
d228e18c458c31492267b3167e1bde3b8702de493ea612d0ecf400835f490982
6097ee7a7f386804b11c435db24b34c3e54bb26b4cb4569c6c8c06f471513c73
c97ea7770bdc793b6e4f5ecdd0ab4454b51475faebb2368f338f620b353a0db1
6db572b2a372da55a29c00656ffdc03d279b01a57eaf854f58441847d3915ebc
9ea23f24620fd64243f22df105d30b97810377238aed2fd83aa31665198175db
26b24f28b0173c020071085d65b260207d5856a8a93c1c1acce7d5cca5e8835f
101159b2df3d82639b34a56f1b72524504492b91c80543689484a6e4ead0848c
a51e73ec5bca72dcebd78f128e76fa4bcb942ee0509d9c549e721806301a3e13
5be80161a65053eed5a2e9f84fd3c28eed3b40df540614ac86b56f6c5a3a5233
c27f65a625e611d0d29febe606a4e48421b30085f1536fe18fa8d41e665ccced
240970ef6292a02db1cd7c6fec1aa55036b11a20a3bed21318a056f9063e5088
SH256 hash:
47b0808dc672bdab43262faac9ee31d26f18ecd0527419ee9a8ded53e508e2b9
MD5 hash:
6339f06b4dea9250f8009b63ddee95e6
SHA1 hash:
b010c6e985916d5b1c4148870a7093ad324e06ff
Link:
https://www.unpac.me/results/223a63bd-0f7c-44af-b159-a866115f0930/
SH256 hash:
fcc249e21fb278d56fcc3758f3b5f3730420688791b2195255ae8e6cc4bc5334
MD5 hash:
1442bc371c383f75302edc99bfabdd80
SHA1 hash:
4a715e4f5f84f545e18af09b3781b3b2926f2b34
Link:
https://www.unpac.me/results/223a63bd-0f7c-44af-b159-a866115f0930/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.50
Link:
https://yomi.yoroi.company/submissions/fcc249e21fb278d56fcc3758f3b5f3730420688791b2195255ae8e6cc4bc5334

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/262316/

Comments