DBatLoaderMalware
- ModiLoader
- natsoloader
This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
6 of 44 · each with the sentence it comes from- T1005Data from Local System
“T1005 Data from Local System”
- T1007System Service Discovery
“T1007 System Service Discovery”
- T1012Query Registry
“T1012 Query Registry”
- T1014Rootkit
“T1014 Rootkit”
- T1020Automated Exfiltration
“T1020 Automated Exfiltration”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
What the reports say
1 report, newest first · the exact sentence from each-
Package deal: Malware bundles causing disruption and damage across EMEA“ModiLoader/DBatLoader.”
Indicators in its reports
named in the reports above- hxxps://digitalfitsoft[.]comin 1 report
- digitalfitsoft[.]comin 1 report
- hxxps://installmentloan7vrt[.]orgin 1 report
- installmentloan7vrt[.]orgin 1 report
- soft-you[.]comin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.