Skip to content
MalwareWiki

Loader

DBatLoader

aka ModiLoader · NatsoLoader

This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component.

DBatLoader, also known as ModiLoader, NatsoLoader, is a Windows loader.

Background

This Delphi-based loader abuses cloud storage services such as Google Drive to retrieve its Delphi stager component. The stager carries the actual payload embedded as a resource and then launches it.

Source: Malpedia (Fraunhofer FKIE).