RedLine Stealer (Malware Family)

RedLine Stealer

Redline Stealer is a malware available on underground forums for sale apparently as standalone versions or also on a subscription basis. This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of Redliune added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.

References

2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader

2020-03-19 ⋅ Bleeping Computer ⋅ Lawrence Abrams
RedLine Info-Stealing Malware Spread by Folding@home Phishing
RedLine Stealer

2020-03-16 ⋅ Proofpoint ⋅ Jeremy H, Axel F, Proofpoint Threat Insight Team
New RedLine Stealer Distributed Using Coronavirus-themed Email Campaign
RedLine Stealer

2020-03-16 ⋅ Proofpoint ⋅ Sherrod DeGrippo
TA505 and Others Launch New Coronavirus Campaigns; Now the Largest Collection of Attack Types in Years
RedLine Stealer

There is no Yara-Signature yet.

RedLine Stealer Propose Change

References

RedLine Stealer