RedLine Stealer is an information-stealing malware that harvests credentials and other sensitive data from browsers and apps, and it can deliver other malicious programs like ransomware, RATs, trojans, and miners. It leverages social engineering to spread via email campaigns and is analyzed using ANY.RUN for lifecycle and behavior insights. #RedLineStealer #AnyRun #Proofpoint #Raccoon #Pony
Keypoints
- RedLine Stealer is an infostealer that targets passwords, credit card details, usernames, autofill data, cookies, and even hardware configurations.
- Attacks often deliver additional malware (ransomware, RATs, trojans, miners) using RedLine as a delivery mechanism.
- It is a .NET-based program written in C# with relatively high code quality, indicating skilled developers behind its updates and features.
- Delivery relies on social engineering and email campaigns (phishing, BEC, fake updates) with various file formats (Office, PDF, RAR/ZIP, EXE, JavaScript).
- RedLine can download secondary payloads and perform actions like uploading/downloading files and executing commands before exiting.
- ANY.RUN is used to analyze RedLine, showing its lifecycle and enabling deeper inspection via customizable reports.
- Detection is aided by Suricata IDS triggers when the infostealer starts transmitting stolen data to its C2 panel.
MITRE Techniques
- [T1555.003] Credentials from Web Browsers – Takes information from browsers, systems instant messaging, and file transfer protocol clients. Quote: ‘The main target is passwords, credit card information, username, location, autofill data, cookies, software set, and even hardware configuration like keyboard layout, UAC settings, etc.’
- [T1566.001] Phishing: Spearphishing Attachment – Uses social engineering for email campaigns including business email compromise, spam, fake updates, ads in Google result in malicious attachments or links. Quote: ‘social engineering for different email campaigns including business email compromise, spam, fake updates, ads in Google result in malicious attachments or links.’
- [T1105] Ingress Tool Transfer – Downloads and executes additional payloads; used to download other malicious programs after opening attachments. Quote: ‘If you open the files in the attachment, RedLine will download other malicious programs.’
- [T1071.001] Web Protocols – Exfiltrates data to a Command & Control panel over web protocols. Quote: ‘sends it to the Command & Control panel.’
- [T1027] Obfuscated/Compressed Files and Information – Stolen information is sent in non-encrypted and base64 encoded formats. Quote: ‘Stolen information is sent in both non-encrypted and base64 encoded formats.’
Indicators of Compromise
- [File] Attachments used for delivery – Office, PDF, RAR and ZIP, Executable files, JavaScript
- [Domain] Any.Run platform – used for malware analysis and visualization (ANY.RUN)
- [URL] Source page – https://any.run/malware-trends/redline
Read more: https://any.run/malware-trends/redline