MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e9d0eab2da8bc25684e95fae693d1d3a712eaca9e25949f749821ece1d4de41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ModernLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e9d0eab2da8bc25684e95fae693d1d3a712eaca9e25949f749821ece1d4de41
SHA3-384 hash: ef737ba8d6a51bef1625c90bb1db6fead36f61cabdda705e8cd20e5806248ed85c00ea55d1d32c426c678c758d87f66c
SHA1 hash: e067ba3a27e2ba5ee5eb725f67c2f6a8383ef121
MD5 hash: 88f88e236505ce206101e2bf9a461342
humanhash: florida-emma-charlie-minnesota
File name:friday.dll
Download: download sample
Signature ModernLoader
Create hunting rule
File size:80'384 bytes
First seen:2023-04-07 21:37:14 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 1536:YBQTBTRq7grw6n3Bjyb5YLGqVw/YjCOu1mpH7dKUdzw4yOED:+QTBTREewg3BjyNYCqVw/cCOn5D1wPOY
Threatray 17 similar samples on MalwareBazaar
TLSH T10A738D4237F58A56CD6ABB7A884706940738D6027D03E76ABCC4A22D0D533EDFE41A4E
TrID 88.8% (.DLL) Generic .NET DLL/Assembly (236632/4/32)
3.9% (.EXE) Win64 Executable (generic) (10523/12/4)
2.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win32 Executable (generic) (4505/5/1)
0.7% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter Anonymous
Tags:dll ModernLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
293
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/380811/
Detection(s):
Win.Loader.ModernLoader-9963553-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
modernloader obfuscated packed
Link:
https://www.filescan.io/uploads/64308d3a2254dc891204b393/reports/03169101-a146-4e44-a8f5-6402370a7096/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/6e9d0eab2da8bc25684e95fae693d1d3a712eaca9e25949f749821ece1d4de41
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
ModernLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e5517c0c-87bb-4cfe-abc2-9c97c89786af
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1210439
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 843351 Sample: friday.dll Startdate: 07/04/2023 Architecture: WINDOWS Score: 56 15 Multi AV Scanner detection for submitted file 2->15 17 .NET source code contains potential unpacker 2->17 19 Machine Learning detection for sample 2->19 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e9d0eab2da8bc25684e95fae693d1d3a712eaca9e25949f749821ece1d4de41/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2oq5kznvc6ck2cosx5one6r2otrf2wktyszjh3utaq6zyou3zaq._file
Verdict:
unknown
Similar samples:
0276c7cb84718b072f43be1600d93e1fa488cb8b35efdf443bafe074f89c1c20
ModernLoader
3970a9fddbcbafb110f7d4fa7dc63ca5508ff32007d2ab2d89ffe54a3439c0b5
ModernLoader
4a918ffe62fbbf1e196ed10be9a772a9a7889c43056ae8b3ebd16ece60a3b589
ModernLoader
4e47aacea0a261d290baf16b29636e778a5de66deff6e5bc3fbf04c88f77a05a
ModernLoader
55007e5a5bb57dbd7c9c4137cb452ef7cef8c40d268eeac4de7f40e49e8b9e25
ModernLoader
6e8bf74388ea7fd0920ba751b8815fc3cf8b08718062695e1860ba9afa961e12
ModernLoader
aac1a251a0246a8271d3a6274fce25e29608bd15cb1c3382232384923b6700c8
ModernLoader
d0af793e1384ddf8f41040c2de0ef1fa13a979644a4220c6f0dfb4a9c066bbd1
ModernLoader
e9e8b9ee9e7586f386f0015813aff0288c230e8277353a3df75d11f7ce13d02e
ModernLoader
eb5573984eac228c2ad2009a61debb47656e3a36e30f2a5ee02d62afdf689cb1
ModernLoader
+ 7 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230407-1g1zpace91/
Unpacked files
SH256 hash:
6e9d0eab2da8bc25684e95fae693d1d3a712eaca9e25949f749821ece1d4de41
MD5 hash:
88f88e236505ce206101e2bf9a461342
SHA1 hash:
e067ba3a27e2ba5ee5eb725f67c2f6a8383ef121
Link:
https://www.unpac.me/results/3d2ac3f8-4ffe-40c1-b20e-92253ce40ae2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/6e9d0eab2da8bc25684e95fae693d1d3a712eaca9e25949f749821ece1d4de41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ModernLoader

PowerShell (PS) ps1 7f4f2ba2347cd4e83db8bfcd3c57849011ce6508b2f10cb367caff3d0626fba7

ModernLoader

DLL dll 6e9d0eab2da8bc25684e95fae693d1d3a712eaca9e25949f749821ece1d4de41

(this sample)

  
Dropped by
SHA256 7f4f2ba2347cd4e83db8bfcd3c57849011ce6508b2f10cb367caff3d0626fba7
  
URLhaus
https://urlhaus.abuse.ch/url/2601435/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/380811/
  
Dropped by
MD5 a20c862aee6c35614e1bade90e3645d2

Comments