RedLine Stealer (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.redline_stealer (Back to overview)

RedLine Stealer

RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.

References

2022-01-20 ⋅ SANS ISC InfoSec Forums ⋅ Xavier Mertens
RedLine Stealer Delivered Through FTP
RedLine Stealer

2022-01-19 ⋅ Chainanalysis ⋅ Chainalysis Team
Meet the Malware Families Helping Hackers Steal and Mine Millions in Cryptocurrency
Glupteba RedLine Stealer

2022-01-10 ⋅ Fortinet ⋅ Shunichi Imano, Fred Gutierrez
COVID Omicron Variant Lure Used to Distribute RedLine Stealer
RedLine Stealer

2022-01-03 ⋅ AhnLab ⋅ ASEC Analysis Team
Distribution of Redline Stealer Disguised as Software Crack
DanaBot RedLine Stealer vidar

2021-12-02 ⋅ Cisco ⋅ Tiago Pereira
Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension
Azorult RedLine Stealer

2021-11-29 ⋅ Trend Micro ⋅ Jaromír Hořejší
Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites
AsyncRAT Azorult Nanocore RAT NjRAT RedLine Stealer Remcos

2021-11-02 ⋅ Minerva ⋅ Natalie Zargarov
Underminer Exploit Kit: The More You Check The More Evasive You Become
Amadey Oski Stealer RedLine Stealer UnderminerEK

2021-10-21 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Massive campaign uses YouTube to push password-stealing malware
Raccoon RedLine Stealer

2021-10-14 ⋅ Recorded Future ⋅ Insikt Group®
RedLine Stealer Is Key Source of Identity Data for Criminal Shops
RedLine Stealer

2021-09-27 ⋅ Cyber-Anubis ⋅ Nidal Fikri
RedLine Infostealer | Detailed Reverse Engineering
RedLine Stealer

2021-09-27 ⋅ Trend Micro ⋅ Ryan Maglaque, Joelson Soares, Gilbert Sison, Arianne Dela Cruz, Warren Sto.Tomas
Fake Installers Drop Malware and Open Doors for Opportunistic Attackers
RedLine Stealer Socelars vidar

2021-08-26 ⋅ Minerva Labs ⋅ Minerva Labs
Become A VIP Victim With New Discord Distributed Malware
BlackNET RAT RedLine Stealer

2021-07-12 ⋅ IBM ⋅ Melissa Frydrych, Claire Zaboeva, Dan Dash
RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos

2021-07-12 ⋅ Cipher Tech Solutions ⋅ Melissa Frydrych, Claire Zaboeva, Dan Dash
RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos

2021-07-08 ⋅ Blackberry ⋅ The BlackBerry Research and Intelligence Team
Threat Thursday: Redline Infostealer
RedLine Stealer

2021-06-14 ⋅ Blaze's Security Blog ⋅ BartBlaze
Digital artists targeted in RedLine infostealer campaign
RedLine Stealer

2021-06-02 ⋅ Morphisec ⋅ Michael Gorelik
Google PPC Ads Deliver Redline, Taurus, and mini-Redline Infostealers
RedLine Stealer Taurus Stealer

2021-04-27 ⋅ Minerva Labs ⋅ Minerva Labs
RedLine Stealer Masquerades as Telegram Installer
RedLine Stealer

2021-01-18 ⋅ Medium csis-techblog ⋅ Benoît Ancel
GCleaner — Garbage Provider Since 2019
Amadey Ficker Stealer Raccoon RedLine Stealer SmokeLoader STOP

2020-10-05 ⋅ Juniper ⋅ Paul Kimayong
New pastebin-like service used in multiple malware campaigns
Agent Tesla LimeRAT RedLine Stealer

2020-09-07 ⋅ Github (StrangerealIntel) ⋅ StrangerealIntel
Time to take the bull by the horns
RedLine Stealer Taurus Stealer

2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader

2020-03-19 ⋅ Bleeping Computer ⋅ Lawrence Abrams
RedLine Info-Stealing Malware Spread by Folding@home Phishing
RedLine Stealer

2020-03-16 ⋅ Proofpoint ⋅ Sherrod DeGrippo
TA505 and Others Launch New Coronavirus Campaigns; Now the Largest Collection of Attack Types in Years
RedLine Stealer

2020-03-16 ⋅ Proofpoint ⋅ Jeremy H, Axel F, Proofpoint Threat Insight Team
New RedLine Stealer Distributed Using Coronavirus-themed Email Campaign
RedLine Stealer

There is no Yara-Signature yet.

RedLine Stealer Propose Change

References

RedLine Stealer