Loading malware…
DBatLoader, also known as ModiLoader and NatsoLoader, is a Windows malware loader written in Delphi that is used to retrieve, decrypt, and execute additional payloads. It has been observed delivering commodity malware families including Warzone RAT, Remcos RAT, NetWire, and Formbook. Delivery commonly begins with phishing lures, including HTML or archive attachments that ultimately launch the loader, and DBatLoader has also been associated with abuse of public cloud and content-hosting services such as OneDrive, Google Drive, and Discord for staging later payloads.
The loader uses multilayer obfuscation and has been documented concealing encrypted second-stage content in resources, including steganographic storage within image data. It decodes payloads in memory and executes them directly, including through shellcode-based staging and process hollowing. Observed samples allocate memory with standard Windows APIs and reconstruct either DLL or executable second stages before transfer of execution.
DBatLoader also incorporates defense-evasion and persistence features. Reported behavior includes use of PowerShell to weaken Microsoft Defender coverage, establishment of autorun persistence in the current user context, and self-copying to user-accessible locations. Some samples abuse User Account Control bypass techniques based on mock trusted directories and relative-path DLL hijacking involving auto-elevated binaries, allowing elevated execution without a normal prompt. Persistence has also been achieved through malicious shortcut-based execution.
The malware is best characterized as a loader rather than the final intrusive payload. Its operational role is to bridge initial access and payload deployment, after which delivered malware may provide remote access, credential theft, or other post-compromise functionality. DBatLoader is part of a broader ecosystem of commodity malware distribution and is notable for flexible staging, in-memory execution, cloud-service abuse, and practical Windows-focused evasion techniques.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Opening the malicious attachment executes an HTML file with embedded JavaScript that is highly likely generated by an LLM. This script is designed to download and execute additional payloads
Opening the malicious attachment executes an HTML file with embedded JavaScript that is highly likely generated by an LLM. This script is designed to download and execute additional payloads
It creates a link element that points to the data of Purchase-Order.7z and uses the click() method to “download” Purchase-Order.7z.
After decrypting these bytes, the payload is executed using a technique known as Process Hollowing. Simply put, the code is injected through the following steps: The target process is created in a suspended state with CreateProcessA; The original process’ code section is removed with NtUnmapViewOfSection; New space is allocated in the process with VirtualAllocEx; The malicious code is written using WriteProcessMemory; Finally, the code is resumed with SetThreatContext and ResumeThread.
it appears to contain scripts and a large blob of base64-encoded data... DBatLoader typically performs download obfuscated later stage payloads
DBatLoader's resource section contains a GIF image as the second stage encrypted payload.
The ISO image contains a Windows executable (EXE) file for ModiLoader. The EXE file icon impersonates an Excel spreadsheet.
After decrypting these bytes, the payload is executed using a technique known as Process Hollowing. Simply put, the code is injected through the following steps: The target process is created in a suspended state with CreateProcessA; The original process’ code section is removed with NtUnmapViewOfSection; New space is allocated in the process with VirtualAllocEx; The malicious code is written using WriteProcessMemory; Finally, the code is resumed with SetThreatContext and ResumeThread.
The encrypted byte from the resource section is added to the number 79... individual bytes are retrieved to decode the second stage DLL payload.
Therefore, the attacker copies 'easinvoker.exe' to the mock directory and uses it to load the malicious 'netutils.dll', which in turn executes the 'KDECO.bat' script.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Uncovering DDGroup — A long-time threat actor AsyncRAT Ave Maria BitRAT DBatLoader NetWire RC Quasar RAT XWorm
A Delphi-compiled loader that uses multi-layer obfuscation and image steganography to conceal its initial stage, decodes an encrypted second-stage payload from resources, allocates it in memory with VirtualAlloc, and executes follow-on payloads. It downloads obfuscated later-stage payloads from public cloud services such as OneDrive and Google Drive, drops helper files to disk, uses a mock trusted directories UAC bypass and DLL hijacking for privilege escalation, excludes directories from Microsoft Defender scanning, and establishes persistence via a .url file and HKCU Run registry key.
The content is centered on DBatLoader and provides YARA detection rules for the Windows malware family. Based on the naming and rule context, it is treated as a malware loader family, but no operational behavior beyond detection logic is described in the content.
A loader mentioned as being deployed alongside DarkCloud in some campaigns.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.