| SYMBOL | COMMON_NAME | aka. SYNONYMS |
RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.
| 2023-04-16 ⋅ OALabs ⋅ XORStringsNet Agent Tesla RedLine Stealer |
| 2023-04-12 ⋅ Spamhaus ⋅ Spamhaus Botnet Threat Update Q1 2023 FluBot Amadey AsyncRAT Aurora Ave Maria BumbleBee Cobalt Strike DCRat Emotet IcedID ISFB NjRAT QakBot RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee Vidar |
| 2023-04-10 ⋅ Twitter (@embee_research) ⋅ Redline Stealer - Static Analysis and C2 Extraction Amadey RedLine Stealer |
| 2023-03-30 ⋅ loginsoft ⋅ From Innocence to Malice: The OneNote Malware Campaign Uncovered Agent Tesla AsyncRAT DOUBLEBACK Emotet Formbook IcedID NetWire RC QakBot Quasar RAT RedLine Stealer XWorm |
| 2023-03-26 ⋅ Updates from the MaaS: new threats delivered through NullMixer Fabookie Nullmixer PseudoManuscrypt Raccoon RedLine Stealer |
| 2023-03-16 ⋅ Trend Micro ⋅ IPFS: A New Data Frontier or a New Cybercriminal Hideout? Agent Tesla Formbook RedLine Stealer Remcos |
| 2023-03-15 ⋅ Avast ⋅ (Ab)using Adobe Acrobat Sign to distribute malware RedLine Stealer |
| 2023-03-09 ⋅ Kaspersky ⋅ Malvertising through search engines RedLine Stealer |
| 2023-03-01 ⋅ Zscaler ⋅ OneNote: A Growing Threat for Malware Distribution AsyncRAT Cobalt Strike IcedID QakBot RedLine Stealer |
| 2023-02-27 ⋅ PRODAFT Threat Intelligence ⋅ RIG Exploit Kit: In-Depth Analysis Dridex IcedID ISFB PureCrypter Raccoon RecordBreaker RedLine Stealer Royal Ransom Silence SmokeLoader Zloader |
| 2023-02-08 ⋅ NTT Security ⋅ SteelClover Attacks Distributing Malware Via Google Ads Increased BATLOADER ISFB RedLine Stealer |
| 2023-02-02 ⋅ YouTube (SLEUTHCON) ⋅ Lions, Tigers, and Infostealers - Oh my! RecordBreaker RedLine Stealer Vidar |
| 2023-01-04 ⋅ Unpacking RedLine Stealer RedLine Stealer |
| 2022-10-13 ⋅ Spamhaus ⋅ Spamhaus Botnet Threat Update Q3 2022 FluBot Arkei Stealer AsyncRAT Ave Maria BumbleBee Cobalt Strike DCRat Dridex Emotet Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT QakBot RecordBreaker RedLine Stealer Remcos Socelars Tofsee Vjw0rm |
| 2022-10-05 ⋅ Fortinet ⋅ Excel Document Delivers Multiple Malware by Exploiting CVE-2017-11882 – Part II Formbook RedLine Stealer |
| 2022-09-29 ⋅ Team Cymru ⋅ Seychelles, Seychelles, on the C(2) Shore: An overview of a bulletproof hosting provider named ELITETEAM. Amadey Raccoon RedLine Stealer SmokeLoader STOP |
| 2022-09-26 ⋅ Kaspersky ⋅ NullMixer: oodles of Trojans in a single dropper ColdStealer DanaBot GCleaner Nullmixer PrivateLoader PseudoManuscrypt RedLine Stealer SmokeLoader Vidar |
| 2022-09-19 ⋅ Fortinet ⋅ Excel Document Delivers Multiple Malware By Exploiting CVE-2017-11882 – Part I Formbook RedLine Stealer |
| 2022-09-15 ⋅ Kaspersky ⋅ Self-spreading stealer attacks gamers via YouTube RedLine Stealer |
| 2022-09-15 ⋅ Sekoia ⋅ PrivateLoader: the loader of the prevalent ruzki PPI service Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer |
| 2022-08-31 ⋅ BitSight ⋅ Tracking PrivateLoader: Malware Distribution Service PrivateLoader RedLine Stealer SmokeLoader |
| 2022-08-30 ⋅ Cisco ⋅ ModernLoader delivers multiple stealers, cryptominers and RATs Coinminer DCRat ModernLoader RedLine Stealer SapphireMiner SystemBC |
| 2022-08-29 ⋅ Sekoia ⋅ Traffers: a deep dive into the information stealer ecosystem MetaStealer PrivateLoader Raccoon RedLine Stealer Vidar |
| 2022-08-29 ⋅ 360 netlab ⋅ PureCrypter Loader continues to be active and has spread to more than 10 other families 404 Keylogger Agent Tesla AsyncRAT Formbook RedLine Stealer |
| 2022-08-23 ⋅ Zscaler ⋅ Making victims pay, infostealer malwares mimick pirated-software download sites RedLine Stealer |
| 2022-08-17 ⋅ Secureworks ⋅ DarkTortilla Malware Analysis Agent Tesla AsyncRAT Cobalt Strike DarkTortilla Nanocore RAT RedLine Stealer |
| 2022-08-10 ⋅ Palo Alto Networks Unit 42 ⋅ BlueSky Ransomware: Fast Encryption via Multithreading BlueSky RedLine Stealer |
| 2022-08-08 ⋅ N1ght-W0lf Blog ⋅ YARA for config extraction RedLine Stealer |
| 2022-08-08 ⋅ Medium CSIS Techblog ⋅ An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader |
| 2022-08-02 ⋅ Recorded Future ⋅ Initial Access Brokers Are Key to Rise in Ransomware Attacks Azorult BlackMatter Conti Mars Stealer Raccoon RedLine Stealer Taurus Stealer Vidar |
| 2022-08-01 ⋅ SecurityScorecard ⋅ A Detailed Analysis of the RedLine Stealer RedLine Stealer |
| 2022-08-01 ⋅ SecurityScorecard ⋅ A Detailed Analysis of the RedLine Stealer RedLine Stealer |
| 2022-07-13 ⋅ KELA ⋅ The Next Generation of Info Stealers Arkei Stealer Azorult BlackGuard Eternity Stealer Ginzo Stealer Mars Stealer MetaStealer Raccoon RedLine Stealer Vidar |
| 2022-06-28 ⋅ AhnLab ⋅ New Info-stealer Disguised as Crack Being Distributed ClipBanker CryptBot Raccoon RedLine Stealer |
| 2022-06-15 ⋅ Qualys ⋅ Fake Cracked Software Caught Peddling Redline Stealers RedLine Stealer |
| 2022-05-25 ⋅ Team Cymru ⋅ Bablosoft; Lowering the Barrier of Entry for Malicious Actors BlackGuard BumbleBee RedLine Stealer |
| 2022-05-19 ⋅ Blackberry ⋅ .NET Stubs: Sowing the Seeds of Discord (PureCrypter) Aberebot AbstractEmu AdoBot 404 Keylogger Agent Tesla Amadey AsyncRAT Ave Maria BitRAT BluStealer Formbook LimeRAT Loki Password Stealer (PWS) Nanocore RAT Orcus RAT Quasar RAT Raccoon RedLine Stealer WhisperGate |
| 2022-05-17 ⋅ Microsoft Security ⋅ In hot pursuit of ‘cryware’: Defending hot wallets from attacks Mars Stealer RedLine Stealer |
| 2022-05-12 ⋅ Morphisec ⋅ New SYK Crypter Distributed Via Discord AsyncRAT Ave Maria Nanocore RAT NjRAT Quasar RAT RedLine Stealer |
| 2022-05-12 ⋅ Netskope ⋅ RedLine Stealer Campaign Using Binance Mystery Box Videos to Spread GitHub-Hosted Payload RedLine Stealer |
| 2022-05-10 ⋅ eSentire ⋅ Redline Stealer Masquerades as Photo Editing Software RedLine Stealer |
| 2022-04-27 ⋅ Bitdefender ⋅ RedLine Stealer Resurfaces in Fresh RIG Exploit Kit Campaign RedLine Stealer |
| 2022-04-25 ⋅ muha2xmad ⋅ Full RedLine malware analysis | IoCs | Stealing information RedLine Stealer |
| 2022-04-18 ⋅ Bitdefender ⋅ RedLine Stealer Analysis RedLine Stealer |
| 2022-04-14 ⋅ Cisco Talos ⋅ Threat Spotlight: "Haskers Gang" Introduces New ZingoStealer RedLine Stealer |
| 2022-03-24 ⋅ paloalto Netoworks: Unit42 ⋅ Threat Brief: Lapsus$ Group RedLine Stealer |
| 2022-03-23 ⋅ SecurityAffairs ⋅ It’s official, Lapsus$ gang compromised a Microsoft employee’s account RedLine Stealer |
| 2022-03-23 ⋅ KrebsOnSecurity ⋅ A Closer Look at the LAPSUS$ Data Extortion Group RedLine Stealer |
| 2022-03-22 ⋅ The Hacker News ⋅ Microsoft and Okta Confirm Breach by LAPSUS$ Extortion Group RedLine Stealer |
| 2022-03-22 ⋅ Bleeping Computer ⋅ Microsoft confirms they were hacked by Lapsus$ extortion group RedLine Stealer |
| 2022-03-22 ⋅ Microsoft ⋅ DEV-0537 (UNC3661) criminal actor targeting organizations for data exfiltration and destruction RedLine Stealer LAPSUS |
| 2022-03-13 ⋅ Bleeping Computer ⋅ Fake Valorant cheats on YouTube infect you with RedLine stealer RedLine Stealer |
| 2022-03-03 ⋅ Medium s2wlab ⋅ Deep Analysis of Redline Stealer: Leaked Credential with WCF RedLine Stealer |
| 2022-02-09 ⋅ BleepingComputer ⋅ Fake Windows 11 upgrade installers infect you with RedLine malware RedLine Stealer |
| 2022-02-08 ⋅ HP ⋅ Attackers Disguise RedLine Stealer as a Windows 11 Upgrade RedLine Stealer |
| 2022-02-08 ⋅ Intel 471 ⋅ PrivateLoader: The first step in many malware schemes Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar |
| 2022-02-07 ⋅ Trellix ⋅ Trellix Global Defenders: Invasion of the Information Snatchers - Protecting against RedLine Infostealer RedLine Stealer |
| 2022-01-20 ⋅ blog.rootshell.be ⋅ [SANS ISC] RedLine Stealer Delivered Through FTP RedLine Stealer |
| 2022-01-20 ⋅ SANS ISC InfoSec Forums ⋅ RedLine Stealer Delivered Through FTP RedLine Stealer |
| 2022-01-19 ⋅ Chainanalysis ⋅ Meet the Malware Families Helping Hackers Steal and Mine Millions in Cryptocurrency Glupteba RedLine Stealer |
| 2022-01-10 ⋅ Fortinet ⋅ COVID Omicron Variant Lure Used to Distribute RedLine Stealer RedLine Stealer |
| 2022-01-03 ⋅ AhnLab ⋅ Distribution of Redline Stealer Disguised as Software Crack DanaBot RedLine Stealer Vidar |
| 2022-01-02 ⋅ Atomic Matryoshka ⋅ "Cracking Open the Malware Piñata" Series: Intro to Dynamic Analysis with RedLineStealer RedLine Stealer |
| 2021-12-02 ⋅ Cisco ⋅ Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension Azorult RedLine Stealer |
| 2021-11-29 ⋅ Trend Micro ⋅ Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites AsyncRAT Azorult Nanocore RAT NjRAT RedLine Stealer Remcos |
| 2021-11-02 ⋅ Minerva ⋅ Underminer Exploit Kit: The More You Check The More Evasive You Become Amadey Oski Stealer RedLine Stealer UnderminerEK |
| 2021-10-21 ⋅ Bleeping Computer ⋅ Massive campaign uses YouTube to push password-stealing malware Raccoon RedLine Stealer |
| 2021-10-14 ⋅ Recorded Future ⋅ RedLine Stealer Is Key Source of Identity Data for Criminal Shops RedLine Stealer |
| 2021-09-27 ⋅ Trend Micro ⋅ Fake Installers Drop Malware and Open Doors for Opportunistic Attackers RedLine Stealer Socelars Vidar |
| 2021-09-27 ⋅ Cyber-Anubis ⋅ RedLine Infostealer | Detailed Reverse Engineering RedLine Stealer |
| 2021-08-26 ⋅ Minerva Labs ⋅ Become A VIP Victim With New Discord Distributed Malware BlackNET RAT RedLine Stealer |
| 2021-08-04 ⋅ ASEC ⋅ S/W Download Camouflage, Spreading Various Kinds of Malware Raccoon RedLine Stealer Remcos Vidar |
| 2021-07-12 ⋅ IBM ⋅ RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation 404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos |
| 2021-07-12 ⋅ Cipher Tech Solutions ⋅ RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation 404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos |
| 2021-07-08 ⋅ Blackberry ⋅ Threat Thursday: Redline Infostealer RedLine Stealer |
| 2021-06-14 ⋅ Blaze's Security Blog ⋅ Digital artists targeted in RedLine infostealer campaign RedLine Stealer |
| 2021-06-02 ⋅ Morphisec ⋅ Google PPC Ads Deliver Redline, Taurus, and mini-Redline Infostealers RedLine Stealer Taurus Stealer |
| 2021-04-27 ⋅ Minerva Labs ⋅ RedLine Stealer Masquerades as Telegram Installer RedLine Stealer |
| 2021-01-18 ⋅ Medium csis-techblog ⋅ GCleaner — Garbage Provider Since 2019 Amadey Ficker Stealer Raccoon RedLine Stealer SmokeLoader STOP |
| 2020-10-05 ⋅ Juniper ⋅ New pastebin-like service used in multiple malware campaigns Agent Tesla LimeRAT RedLine Stealer |
| 2020-09-07 ⋅ Github (StrangerealIntel) ⋅ Time to take the bull by the horns RedLine Stealer Taurus Stealer |
| 2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Botnet Threat Update Q2 2020 AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader |
| 2020-07-02 ⋅ Zscaler ⋅ CyberGate RAT and RedLine Stealer Delivered in Ongoing AutoIt Malware Campaigns CyberGate RedLine Stealer |
| 2020-03-19 ⋅ Bleeping Computer ⋅ RedLine Info-Stealing Malware Spread by Folding@home Phishing RedLine Stealer |
| 2020-03-16 ⋅ Proofpoint ⋅ New RedLine Stealer Distributed Using Coronavirus-themed Email Campaign RedLine Stealer |
| 2020-03-16 ⋅ Proofpoint ⋅ TA505 and Others Launch New Coronavirus Campaigns; Now the Largest Collection of Attack Types in Years RedLine Stealer |
There is no Yara-Signature yet.