DBatLoader Malware Analysis

File Properties

SHA256: 04f083fb8b7b8ff01c98b972859d03db4de185f81877e180317792e2361043cf

MD5: 4d42a98983e76faf14071bd30f3eae65

File Type: exe

Size: 1,296,896 byte

First Seen: 2023-10-26

AV Signature: DBatLoader

Imphash: 91a1eb4157c5e26a9ad6d8fdf398dbf8

Reported By: abuse_ch

Tags: DBatLoader, exe, gunzipped

Static analysis: metadata-based (sample not downloaded)

DBatLoader — Malware Profile

DBatLoader/ModiLoader. PaymentXAdvice ZIP lure. Brazilian Portuguese targeting. pt-BR locale.

Malware Type
Loader
Programming Language
Delphi
C2 Protocol
HTTP
Target Systems
Windows
Also Known As (AKA)
ModiLoader

Technical Details

Varyanta gore C/C#/VBS/PS1, anti-analysis (VM/debugger check), persistence (Registry/Task Scheduler/Startup folder), payload decryption ve injection (shellcode/PE), fileless execution teknikleri

Capabilities & Behavior

Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı

IOC List (1 indicators)

IOC — DBatLoader
# FILEPATH 04f083fb8b7b8ff01c98b972859d03db4de185f81877e180317792e2361043cf
TypeValueNote
filepath 04f083fb8b7b8ff01c98b972859d03db4de185f81877e180317792e2361043cf PDB
DBatLoader — Go to Full Profile →

C2 Servers (3 recorded servers for this family)

Address Type Port Protocol Status Country
176.32.34.88 ip 80 HTTP active UA
194.33.45.78 ip 443 HTTPS inactive CZ
85.195.206.19 ip 80 HTTP inactive AT

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
DBatLoaderexegunzipped