MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cb286357b8a941afc3a992394e5d44ad00a8410593b182f962619ef506c835e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RedLineStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cb286357b8a941afc3a992394e5d44ad00a8410593b182f962619ef506c835e
SHA3-384 hash: 7fbdb09d6e8c8f48b40ee68b78d9d0eb5cf49e961227e84024b59f966e9a4ea76494f1d15a1edec1ca73f0e27f5ab968
SHA1 hash: 1d172b4b0188a5215f5a0666564ce092fd08833b
MD5 hash: 89a392f9f9724a91263257a46d48daa9
humanhash: batman-moon-bulldog-oregon
File name:extremeinjectorv3.7.2.exe
Download: download sample
Signature RedLineStealer
Create hunting rule
File size:1'043'007 bytes
First seen:2021-04-03 15:54:13 UTC
Last seen:2021-04-03 16:39:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 768:7zZC3eiTF2PO/qQ5agkZc9Kbyl+DE4E8mzpwVm1:RCvF+O3aRN/E4EbX
Threatray 173 similar samples on MalwareBazaar
TLSH 01254C2873E4513AC4AE6EFA54B247440B71F2E25503DF6F98D462A97D937C009273E7
Reporter Anonymous
Tags:RedLineStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
260
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
extremeinjectorv3.7.2.exe
Verdict:
Malicious activity
Analysis date:
2021-04-03 15:56:46 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/4c5c6f31-918b-4eeb-a897-040931a6369d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132009/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.63839.602.30232.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Launching a process
Creating a file
Sending an HTTP POST request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Creating a file in the %temp% directory
Deleting a recently created file
Sending a UDP request
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/665049
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cb286357b8a941afc3a992394e5d44ad00a8410593b182f962619ef506c835e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-02 19:58:25 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1c88f5a9499a54522c8338fb93c326debeb890fb08251ce29fcf19ae7441d11c
RedLineStealer
73188b6122dcf35a0d26fedf3679c9713e6f21ccf78499d8788ed39feb7fdb4a
RedLineStealer
79638b28279f6fc16f4d3a24a73ac67a405aa548aa09d6ca09f485b8e7e13901
RedLineStealer
7af76f869eab565b2b7d3ec5f141e5d8cd94551a6b1b31e0d8af7c3ea2b5a7db
RedLineStealer
abdcbcd7837ddda736f49656e7cba74a20d82335063a7c3c3a57058113f686ab
RedLineStealer
ac229b3885937953446d36f13aec9becdc71cf2edd2a4df4a3a74cd91dfbf8b2
RedLineStealer
c1a85afd7acdaf7ab0d6839cc68d67ca75455fa9fb3d62a95f6579f07899df49
RedLineStealer
c22d25107e48962b162c935a712240c0a4486b38891855f0e53d5eb972406782
RedLineStealer
d27e90665d0a697e1fea9dfc3641c9785bfbf8fbd7ef885d82788943417d1ccd
RedLineStealer
f643cf2250b1ece8e720df93180962e563c6c1e587f4e42af47e4c26ed4ab861
RedLineStealer
+ 163 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210403-8j7qxf1122/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
6cb286357b8a941afc3a992394e5d44ad00a8410593b182f962619ef506c835e
MD5 hash:
89a392f9f9724a91263257a46d48daa9
SHA1 hash:
1d172b4b0188a5215f5a0666564ce092fd08833b
Link:
https://www.unpac.me/results/cbc91ee2-acab-44f6-b693-d2c0003dbf46/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/6cb286357b8a941afc3a992394e5d44ad00a8410593b182f962619ef506c835e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/132009/

Comments