DBatLoader

DBatLoader is a malware loader observed in phishing-driven intrusion chains and referenced alongside other loaders such as Amadey, DarkGate, and GuLoader. The provided content places it in campaigns abusing Windows LNK shortcut files and PowerShell-based execution, and notes that PowerShell is used by DBatLoader to evade detection and download additional payloads. DBatLoader has also been mentioned as being deployed alongside other malware, including DarkCloud and ClipBanker, and in a phishing campaign distributing WarZone RAT via DBatLoader. High-confidence details in the content indicate its role is as a loader used to stage or launch follow-on malware rather than as the final payload. The content does not provide specific DBatLoader-exclusive IOCs, persistence mechanisms, or technical internals beyond its association with phishing, LNK abuse, and PowerShell-enabled payload delivery.