DBatLoader

Technical analysis of DBatLoader/ModiLoader: a Delphi-compiled multi-stage loader that hides an encrypted second-stage payload (stored as a GIF resource) using obfuscation and steganography, decodes it into memory, and executes a second-stage DLL which drops BAT, DLL and EXE artifacts to C:\Users\Public\Libraries. The dropper uses a mock trusted directory UAC bypass with an auto-elevated easinvoker.exe and relative-path DLL hijacking to escalate and run a malicious netutils.dll, modifies Defender exclusions via PowerShell, establishes persistence with a gafiifdX.url autorun entry, and delivers high-impact payloads including Formbook and multiple RAT families.