Procedure examples

RedLine Stealer has collected data stored locally including chat logs and files associated with chat services such as Steam, Discord, and Telegram.

RedLine Stealer can query the Windows Registry.

RedLine Stealer can enumeate information about victims’ systems including IP addresses.

RedLine Stealer has used obfuscation tools such as DNGuard and Boxed App to pack their code.

RedLine Stealer has obfuscated scripts within text files used in execution.

RedLine Stealer has encrypted and encoded configuration data with Base64 and XOR functions.

RedLine Stealer has obtained the username from the victim’s machine.

RedLine Stealer malware has masqueraded as legitimate software such as "PDF Converter Software" which has been distributed through poisoned search engine results often resembling legitimate software lures with the combination of typo squatted domains.

RedLine Stealer has sent victim data to its C2 server or RedLine panel server.

RedLine Stealer has achieved persistence via scheduled tasks.

RedLine Stealer has executed windows cmd using `ErrorHandler.cmd` to create scheduled tasks.

RedLine Stealer malware has leveraged Lua bytecode to perform malicious behavior.

RedLine Stealer has utilized HTTP for C2 communications. RedLine Stealer has also conducted C2 communications to hardcoded C2 servers over HTTPS. RedLine Stealer has leveraged SOAP protocol for C2 communications.

RedLine Stealer can collect information about the local system.

RedLine Stealer has collected account information from the victim’s machine.

RedLine Stealer has leveraged legitimate file sharing web services to host malicious payloads.

RedLine Stealer has the ability download additional payloads.

RedLine Stealer can capture screenshots on a compromised host.

RedLine Stealer has used Base64 to encode command and control traffic.

RedLine Stealer has decoded its payload prior to execution.

RedLine Stealer malware has been executed through the download of malicious files. RedLine Stealer has also lured users to install malware with an Install Wizard interface.

RedLine Stealer can collect information from browsers and browser extensions.

RedLine Stealer has been installed via MSI Installer.

RedLine Stealer has built in settings to not operate based on geolocation or country of the victim host.

RedLine Stealer has an anti-sandbox technique that requires the malware to consistently check with the C2 server, if the communication fails RedLine Stealer will not continue execution.

RedLine Stealer can get a list of programs on the victim device.

RedLine Stealer has identified installed antivirus software on the system.

RedLine Stealer has stolen browser cookies and settings.

RedLine Stealer has used both valid certificates and self-signed digital certificates to appear legitimate.

RedLine Stealer has obtained credentials from VPN services, FTP clients and Instant Messenger (IM)/Chat clients.

RedLine Stealer was designed to steal sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data. RedLine Stealer can also gather credentials from several browsers.

RedLine Stealer has gathered detailed information about victims’ systems, such as IP addresses, and geolocation. RedLine Stealer has also checked the IP from where it was being executed and leveraged an opensource geolocation IP-lookup service.

RedLine Stealer can retrieve system default language and time zone.

RedLine Stealer has collected data from cryptocurrency wallets and harvested credit cards details from browsers.

RedLine Stealer can disable security software and update services.