SYMBOLCOMMON_NAMEaka. SYNONYMS
win.redline_stealer (Back to overview)

RedLine Stealer

RedLine Stealer is a malware available on underground forums for sale apparently as standalone versions or also on a subscription basis. This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.

References
2021-09-27 ⋅ Cyber-Anubis ⋅ Nidal Fikri
@online{fikri:20210927:redline:37cd84a, author = {Nidal Fikri}, title = {{RedLine Infostealer | Detailed Reverse Engineering}}, date = {2021-09-27}, organization = {Cyber-Anubis}, url = {https://cyber-anubis.github.io/malware%20analysis/redline/}, language = {English}, urldate = {2021-10-05} } RedLine Infostealer | Detailed Reverse Engineering
RedLine Stealer
2021-09-27 ⋅ Trend Micro ⋅ Ryan Maglaque, Joelson Soares, Gilbert Sison, Arianne Dela Cruz, Warren Sto.Tomas
@online{maglaque:20210927:fake:e02e3a3, author = {Ryan Maglaque and Joelson Soares and Gilbert Sison and Arianne Dela Cruz and Warren Sto.Tomas}, title = {{Fake Installers Drop Malware and Open Doors for Opportunistic Attackers}}, date = {2021-09-27}, organization = {Trend Micro}, url = {https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html}, language = {English}, urldate = {2021-10-05} } Fake Installers Drop Malware and Open Doors for Opportunistic Attackers
RedLine Stealer Socelars vidar
2021-08-26 ⋅ Minerva Labs ⋅ Minerva Labs
@online{labs:20210826:become:f38fe74, author = {Minerva Labs}, title = {{Become A VIP Victim With New Discord Distributed Malware}}, date = {2021-08-26}, organization = {Minerva Labs}, url = {https://blog.minerva-labs.com/become-a-vip-victim-with-new-discord-distributed-malware}, language = {English}, urldate = {2021-09-12} } Become A VIP Victim With New Discord Distributed Malware
BlackNET RAT RedLine Stealer
2021-07-12 ⋅ Cipher Tech Solutions ⋅ Melissa Frydrych, Claire Zaboeva, Dan Dash
@online{frydrych:20210712:roboski:a3c66bf, author = {Melissa Frydrych and Claire Zaboeva and Dan Dash}, title = {{RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation}}, date = {2021-07-12}, organization = {Cipher Tech Solutions}, url = {https://www.ciphertechsolutions.com/roboski-global-recovery-automation/}, language = {English}, urldate = {2021-07-20} } RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos
2021-07-12 ⋅ IBM ⋅ Melissa Frydrych, Claire Zaboeva, Dan Dash
@online{frydrych:20210712:roboski:1f66418, author = {Melissa Frydrych and Claire Zaboeva and Dan Dash}, title = {{RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation}}, date = {2021-07-12}, organization = {IBM}, url = {https://securityintelligence.com/posts/roboski-global-recovery-automation/}, language = {English}, urldate = {2021-07-20} } RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos
2021-07-08 ⋅ Blackberry ⋅ The BlackBerry Research and Intelligence Team
@online{team:20210708:threat:c31cba6, author = {The BlackBerry Research and Intelligence Team}, title = {{Threat Thursday: Redline Infostealer}}, date = {2021-07-08}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2021/07/threat-thursday-redline-infostealer}, language = {English}, urldate = {2021-07-19} } Threat Thursday: Redline Infostealer
RedLine Stealer
2021-06-14 ⋅ Blaze's Security Blog ⋅ BartBlaze
@online{bartblaze:20210614:digital:f5d4313, author = {BartBlaze}, title = {{Digital artists targeted in RedLine infostealer campaign}}, date = {2021-06-14}, organization = {Blaze's Security Blog}, url = {https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html}, language = {English}, urldate = {2021-06-16} } Digital artists targeted in RedLine infostealer campaign
RedLine Stealer
2021-06-02 ⋅ Morphisec ⋅ Michael Gorelik
@online{gorelik:20210602:google:eb1bf13, author = {Michael Gorelik}, title = {{Google PPC Ads Deliver Redline, Taurus, and mini-Redline Infostealers}}, date = {2021-06-02}, organization = {Morphisec}, url = {https://blog.morphisec.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers}, language = {English}, urldate = {2021-06-16} } Google PPC Ads Deliver Redline, Taurus, and mini-Redline Infostealers
RedLine Stealer Taurus Stealer
2021-04-27 ⋅ Minerva Labs ⋅ Minerva Labs
@online{labs:20210427:redline:f60a1c6, author = {Minerva Labs}, title = {{RedLine Stealer Masquerades as Telegram Installer}}, date = {2021-04-27}, organization = {Minerva Labs}, url = {https://blog.minerva-labs.com/redline-stealer-masquerades-as-telegram-installer}, language = {English}, urldate = {2021-05-04} } RedLine Stealer Masquerades as Telegram Installer
RedLine Stealer
2021-01-18 ⋅ Medium csis-techblog ⋅ Benoît Ancel
@online{ancel:20210118:gcleaner:f8b9064, author = {Benoît Ancel}, title = {{GCleaner — Garbage Provider Since 2019}}, date = {2021-01-18}, organization = {Medium csis-techblog}, url = {https://medium.com/csis-techblog/gcleaner-garbage-provider-since-2019-2708e7c87a8a}, language = {English}, urldate = {2021-01-21} } GCleaner — Garbage Provider Since 2019
Amadey Ficker Stealer Raccoon RedLine Stealer SmokeLoader STOP
2020-10-05 ⋅ Juniper ⋅ Paul Kimayong
@online{kimayong:20201005:new:739309f, author = {Paul Kimayong}, title = {{New pastebin-like service used in multiple malware campaigns}}, date = {2020-10-05}, organization = {Juniper}, url = {https://blogs.juniper.net/en-us/threat-research/new-pastebin-like-service-used-in-multiple-malware-campaigns}, language = {English}, urldate = {2020-10-07} } New pastebin-like service used in multiple malware campaigns
Agent Tesla LimeRAT RedLine Stealer
2020-09-07 ⋅ Github (StrangerealIntel) ⋅ StrangerealIntel
@online{strangerealintel:20200907:time:07064dc, author = {StrangerealIntel}, title = {{Time to take the bull by the horns}}, date = {2020-09-07}, organization = {Github (StrangerealIntel)}, url = {https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/UnknownTA/2020-09-07/Analysis.md}, language = {English}, urldate = {2020-09-15} } Time to take the bull by the horns
RedLine Stealer Taurus Stealer
2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
@techreport{labs:20200730:spamhaus:038546d, author = {Spamhaus Malware Labs}, title = {{Spamhaus Botnet Threat Update Q2 2020}}, date = {2020-07-30}, institution = {Spamhaus}, url = {https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf}, language = {English}, urldate = {2020-07-30} } Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader
2020-03-19 ⋅ Bleeping Computer ⋅ Lawrence Abrams
@online{abrams:20200319:redline:5966456, author = {Lawrence Abrams}, title = {{RedLine Info-Stealing Malware Spread by Folding@home Phishing}}, date = {2020-03-19}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/redline-info-stealing-malware-spread-by-folding-home-phishing/}, language = {English}, urldate = {2020-03-22} } RedLine Info-Stealing Malware Spread by Folding@home Phishing
RedLine Stealer
2020-03-16 ⋅ Proofpoint ⋅ Sherrod DeGrippo
@online{degrippo:20200316:ta505:6cfbbb0, author = {Sherrod DeGrippo}, title = {{TA505 and Others Launch New Coronavirus Campaigns; Now the Largest Collection of Attack Types in Years}}, date = {2020-03-16}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/ta505-and-others-launch-new-coronavirus-campaigns-now-largest-collection-attack}, language = {English}, urldate = {2020-04-26} } TA505 and Others Launch New Coronavirus Campaigns; Now the Largest Collection of Attack Types in Years
RedLine Stealer
2020-03-16 ⋅ Proofpoint ⋅ Jeremy H, Axel F, Proofpoint Threat Insight Team
@online{h:20200316:new:60f8c3d, author = {Jeremy H and Axel F and Proofpoint Threat Insight Team}, title = {{New RedLine Stealer Distributed Using Coronavirus-themed Email Campaign}}, date = {2020-03-16}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign}, language = {English}, urldate = {2020-03-17} } New RedLine Stealer Distributed Using Coronavirus-themed Email Campaign
RedLine Stealer

There is no Yara-Signature yet.