Splunk RedLine Stealer June 2023

RedLine Stealer has encrypted and encoded configuration data with Base64 and XOR functions.

RedLine Stealer has obtained the username from the victim’s machine.

RedLine Stealer has utilized HTTP for C2 communications. RedLine Stealer has also conducted C2 communications to hardcoded C2 servers over HTTPS. RedLine Stealer has leveraged SOAP protocol for C2 communications.

RedLine Stealer can collect information about the local system.

RedLine Stealer has collected account information from the victim’s machine.

RedLine Stealer has leveraged legitimate file sharing web services to host malicious payloads.

RedLine Stealer can capture screenshots on a compromised host.

RedLine Stealer has decoded its payload prior to execution.

RedLine Stealer can collect information from browsers and browser extensions.

RedLine Stealer has an anti-sandbox technique that requires the malware to consistently check with the C2 server, if the communication fails RedLine Stealer will not continue execution.

RedLine Stealer can get a list of programs on the victim device.

RedLine Stealer has stolen browser cookies and settings.

RedLine Stealer has obtained credentials from VPN services, FTP clients and Instant Messenger (IM)/Chat clients.

RedLine Stealer was designed to steal sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data. RedLine Stealer can also gather credentials from several browsers.

RedLine Stealer can retrieve system default language and time zone.

RedLine Stealer has collected data from cryptocurrency wallets and harvested credit cards details from browsers.

RedLine Stealer can disable security software and update services.