RedLine StealerMalware
- recordstealer
RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information.From MISP Galaxy
Last reported 2 days ago, by Group-IB4 reports
ATT&CK techniques
6 of 85 · each with the sentence it comes from- T1555.005Password Managers
“T1555.005”
- T1005Data from Local System
“T1005”
- T1007System Service Discovery
“T1007”
- T1012Query Registry
“T1012”
- T1020Automated Exfiltration
“T1020”
- T1027Obfuscated Files or Information
“T1027”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Inside SiriusQT: A Seriously Skilled RAT“One of the command&control found was previously linked with RedLine Stealer.”
-
Social Engineering in Action: How Fraudsters Exploit Trust with Fake Refund Schemes in the Middle East“… Threat Intelligence data, breaches of government websites in the META region in almost 60% of cases are associated with the use of RedLine Stealer (Figure 2).”
-
Package deal: Malware bundles causing disruption and damage across EMEA“Group-IB researchers found that malware bundles often contained one of two highly popular stealers, RedLine Stealer and Vidar.”
-
FontPack: A dangerous update“… our analysis, it was established that one of the campaigns involving this landing page distributed several types of malware called RedLine Stealer.”
Indicators in its reports
named in the reports above- hxxps://digitalfitsoft[.]comin 1 report
- digitalfitsoft[.]comin 1 report
- hxxps://installmentloan7vrt[.]orgin 1 report
- installmentloan7vrt[.]orgin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.