BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details

DBatLoader

52
Global rank
85 infographic chevron month
Month rank
96 infographic chevron week
Week rank
0
IOCs

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Loader
Type
Unknown
Origin
1 June, 2020
First seen
28 August, 2024
Last seen

How to analyze DBatLoader with ANY.RUN

Type
Unknown
Origin
1 June, 2020
First seen
28 August, 2024
Last seen

IOCs

IP addresses
20.206.228.177
20.252.43.59
40.74.95.186
Hashes
127e920304ce4f148d95d1b2522623262a85b804d682d33df89f1238eac1ffc9
e08e4eb8aed0ba0a861e34391114375bdaf9e958f881819760edd0f09addcb04
d15957b86b40121718e0e4dcf7cc2d548531354c064def0f833971c53162c17c
af2a5455f4de7136e90e94e7bee5ba398d01f09ab9d01ef32bb70e560030b650
2c41b7f3539274c8d29d44e308e9a7983cd0055f931ef41abd518f0e98ba968c
74700d229d57308b3c247f14c3dad6f60a3a1af492a19690967094a741e07a25
46b90babfe4fa66ac9938280e0c884b0d490a34071bd29b846a2aa0c7a89e265
0ca9c20450557ecef3f6e5c07dece6d6fce861312254da1ea2922270b165c56f
c1bcaa3723fd87f8a0a537c14ecf7e5852a69d33995333b40a7a475eb2e1696c
7d42baf12969f24e3f68e53b146b4f049c1f772396c2e68c1a18bf75e26992ad
58f3156e5e1c9357b4acca9aa7a13df6431207e51c4686a88993eb337ab729ea
9aa4d0eb53b0456c4b9354ba96a05997e8d526473eaed3fd1f55d455cdec380c
1f6ff36cb06663db2debdb00c79eb28d95fba22bd7cfa7b72dbb57e635f76469
33ca9923e204fe49ca08062c7799a0edd936be726f89e661756e058677eb4a96
9eec263f371fb7e9a3eb364a332ea20db16547de04e3b57fdc747fab2949312d
a353487493238df8b80d02160ce8ab8391e99e228fb9403082c732f7c5e2a639
877e0258da77f19957476f8f24cb712cf8ba3dc471f0be0442bf1cbd816c227a
7e7845ee07e9f3fb07b6529f5186eeec85495d699026c8dedfd9429cb97da1bd
518d34f7f99881a4540c1d3ce98efc53d7601e8a3e66a016b911c4d0f42dd345
03fcef266ae1dad0fd0441376ed2a2defd8621627681789c719b9d9cc4278cda
Domains
unilateralcospilino.duckdns.org
setimetntalatsuirity.ddnsfree.com
willanime.com
chronotech.online
cybertechglobalai.com
cremation-services-98621.bond
druk.site
bottles2bags.com
chatlhh5.com
assabmould.net
8363k.vip
data-analytics-78756.bond
de-guru.com
cnwsjd.cfd
dingshenghr.net
aeroportlogistics.com
601234.net
323va.com
ecodfairs.top
easyhealthconsulting.com
URLs
https://onedrive.live.com/download?resid=102EE6226FBFD436%21188&authkey=!ADz_JfnmOU9-zo0
https://drive.google.com/uc?export=download&id=17zI5dj94G2TBdkfJGgtbt_3GrZS3oJFR
https://aarzoomarine.com/wp-content/253_Kqxdlqydhpt
https://1021.filemail.com/api/file/get
https://onedrive.live.com/download?resid=F2DC8284E0A31E9E%21191&authkey=!AMs9a0Jkay0zupc
https://onedrive.live.com/download?resid=E0CF7F9E6AAF27EF%211698&authkey=!AP2ndiARY9jfQNI
https://morientlines.com/xerofileupshsgdydpdfseudidofndhehuplosdsdocumentghy/Scxozmyplhmqutylctxlkglsugzstqx
https://2012.filemail.com/api/file/get
https://onedrive.live.com/download?resid=80A2C2010B1BCE07%211238&authkey=!AKCIqpe5wN0S2p0
https://onedrive.live.com/download?resid=38773C188FECDED2%21107&authkey=!APdTZ0yd8fEkIVs
https://onedrive.live.com/download?resid=8B41338C16482EC%21119&authkey=!AM1EpmNihNYEsQs
https://graffae-my.sharepoint.com/:u:/g/personal/estimator_graff_ae/EXU3ymcTlx9HkiSUJwzwH6gBi8hbq87jnAmkgUUdytHBOQ
https://onedrive.live.com/download?resid=BAF30C9243AC3050%21113&authkey=!AL1F5Ls5tRUL_Zc
https://onedrive.live.com/download?resid=FDB0512DE793B32E%21201&authkey=!AKqy7NQ0hsusk7U
https://onedrive.live.com/download?resid=849ABDB14CA5CEC3%21268&authkey=!AGkSae3yLjJ6J50
https://balkancelikdovme.com/work/Elpuxpkilck
https://kamix.hu/255_Gosyggcgyxx
https://onedrive.live.com/download?resid=BB56EEF50A3B985F%21233&authkey=!AIlQkZsq62t1AmQ
http://baitalasma.com/255_Pzuhzgxzrfq
https://onedrive.live.com/download?resid=F0B00474923735E9%21107&authkey=!AC1EYVyMZoYGdi83
Last Seen at

Recent blog posts

post image
ANY.RUN Now Integrates with Splunk!
watchers 314
comments 0
post image
How to Analyze Malware in ANY.RUN Sandbox: Er...
watchers 363
comments 0
post image
Security Training Lab: Educational Program fo...
watchers 1160
comments 0

What is DBatLoader malware?

DBatLoader is a loader written in Delphi that has been in extensive use among attackers since 2020. One of the key features of the malware is its reliance on legitimate cloud-based platforms such as Discord for hosting its payloads. DBatLoader has been involved in numerous campaigns and leveraged to deploy stealers, trojans, and other threats.

In most cases, DBatLoader manages to infect machines via multi-stage attacks. For instance, victims may receive an email attachment in the form of a PDF file. Upon opening the attachment, users may be prompted to click on a seemingly genuine button embedded with a malicious link. Clicking this link will initiate the download of a Windows Cabinet file, which, in turn, will trigger the installation of DBatLoader on the unsuspecting user's computer.

Get started today for free

Easily analyze emerging malware with ANY.RUN interactive online sandbox

Register for free

Technical details of the DBatLoader malicious software

DBatLoader’s sole purpose is to distribute other malware on the devices it manages to infect. To do this, the developers behind DBatLoader have equipped their malicious software with several advanced capabilities.

For example, DBatLoader can avoid User Account Control (UAC) to gain elevated privileges. It does this by exploiting the mock folder vulnerability. In Windows, executables launched from certain system directories can auto-elevate. DBatLoader exploits this by creating a mock folder with the same name as a trusted location, such as "C:\Windows\System32 ".

On top of that, DBatLoader copies a legitimate process to this fake folder and then injects it with its malicious DLL that allows the payload downloaded by DBatLoader to execute freely without any security notifications, achieving sustained persistence.

Another common vulnerability abused by DBatLoader in previous attacks was CVE-2018-0798, an exploit targeting Equation Editor in Microsoft Office. The malware has also been observed to utilize steganography.

As mentioned, DBatLoader is usually configured to pull malicious payloads from servers of popular cloud storage services, including Microsoft OneDrive and Google Drive. Some of the notable examples of malware dropped by DBatLoader are Formbook, Warzone, and Remcos.

Execution process of DBatLoader

In order to detect DBatLoader, it is vital to analyze the latest samples of this malware and collect up-to-date information on it. To this end, we can use ANY.RUN, a malware analysis sandbox that lets us quickly analyze any suspicious file or link to spot threats.

Let’s upload a sample of DBatLoader to ANY.RUN and study its behavior.

In this task, DBatLoader was distributed as an executable file with a name mimicking the title of a document, attempting to trick users into opening the file and executing the malicious code. Upon execution, DBatLoader downloads and injects the Formbook malware into the Control and Explorer system processes, enabling its malicious activity.

Analyze malware for free in a fully interactive cloud sandbox – sign up now!

DBatLoader process tree shown in ANY.RUN DBatLoader's process tree demonstrated in ANY.RUN

In addition, this loader can be used in more sophisticated attacks, such as exploiting vulnerabilities to penetrate the system. These can be familiar vulnerabilities like CVE-2017-11882, as well as lesser known ones. On top of that, DBatLoader can also make use of system utilities in its attacks. In this task, a whole arsenal of system utilities is actively used, such as cmd, ping, and xcopy, including for the purpose of lateral movement. Eventually, DBatLoader drops Remcos that instantly begins its operation.

Distribution methods of the DBatLoader malware

Phishing campaigns constitute the most common vector of attack involving DBatLoader. Emails sent by the operators of the malware target different organizations and are masqueraded as genuine messages. In many cases, criminals even use legitimate email addresses they manage to hijack or gain access to.

The subject of such emails concerns different business-related matters, such as payments and other arrangements. For example, attackers may send fake invoices as Microsoft Office or PDF files. These files usually contain a link that, once clicked, can trigger the infection leading to DBatLoader being dropped on the computer and the eventual deployment of the final payload.

Conclusion

DBatLoader remains an active threat commonly used by criminals in their attacks on various types of organizations. To keep your infrastructure safe, it is essential that you have strong security measures in place, especially when it comes to software for detecting and inspecting threats.

Use the ANY.RUN sandbox as a reliable tool for analyzing emails you receive to safely determine if they pose any danger. ANY.RUN’s interactive cloud environment makes it easy to investigate the most advanced phishing campaigns and uncover multi-stage attacks in minutes. The service provides you with convenient text reports containing all the relevant information on the files and links you submit, including fresh IOCs.

Try ANY.RUN for free – request a demo!

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More