By ZeroDay Malware Intelligence•April 26, 2026•

malware

REDLINE STEALER Malware Analysis: MITRE ATT&CK, IOCs & Detection

title: "REDLINE STEALER Malware Analysis: MITRE ATT&CK, IOCs & Detection"
description: "Complete technical analysis of RedLine Stealer — detection ratio N/A, MITRE ATT&CK mapping, IOCs, behavioral profile, YARA rules, and incident response. Enriched by AI with live MalwareBazaar and OTX data."
date: "2026-04-26"
category: malware
image: "/img/posts/malware.png"
tags: ["malware", "threat-intelligence", "mitre-attck", "redline-stealer", "redline stealer", "ioc", "detection", "cybersecurity"]
author: "ZeroDay Malware Intelligence"
malwareFamily: "RedLine Stealer"
malwareType: "RedLine Stealer"
detectRatio: "N/A"
attackTechniquesCount: "0"

REDLINE STEALER Malware Analysis: MITRE ATT&CK, IOCs & Detection

Detection ratio: N/A | MITRE ATT&CK techniques: see below | Type: RedLine Stealer | Updated: 2026-04-26

This analysis was auto-enriched using live MalwareBazaar samples, VirusTotal reports, and OTX AlienVault threat intelligence, then synthesized and expanded by Ibugsec Corp.

RedLine Stealer: A Deep Dive into a Modern Information Stealer

This report provides a comprehensive technical analysis of RedLine Stealer, a prevalent information stealer targeting a wide range of credentials and sensitive data. We will delve into its operational mechanics, dissect its attack vectors, and provide actionable detection and response strategies for security professionals. The analysis includes a detailed mapping to MITRE ATT&CK techniques, a working YARA rule, Sigma rules, and memory forensics commands, aiming to equip SOC analysts, malware researchers, and red-teamers with the knowledge to identify and mitigate this threat.

Executive Summary

RedLine Stealer is a sophisticated information-stealing malware family that has been active since at least 2020. It is commonly distributed via phishing campaigns, exploit kits, and sometimes through bundled software or cracked applications. The primary objective of RedLine Stealer is to harvest sensitive data from infected systems, including browser credentials, cryptocurrency wallet information, FTP clients, VPN configurations, and system information. Threat actors leverage this stolen data for financial gain, often selling it on underground forums or using it to facilitate further attacks. While direct attribution to specific APT groups is challenging due to its widespread availability and MaaS (Malware-as-a-Service) model, RedLine Stealer has been implicated in numerous campaigns affecting individuals and organizations globally. Recent observations indicate its continued use in widespread attacks, highlighting the persistent threat it poses. The analysis herein focuses on understanding its internal workings to facilitate effective threat hunting and incident response.

How It Works — Technical Deep Dive

RedLine Stealer's operational lifecycle involves several stages, from initial compromise to data exfiltration. Understanding each phase is crucial for effective detection and remediation.

Initial Infection Vector

RedLine Stealer is typically delivered through one of the following methods:

Phishing Campaigns: Malicious email attachments (e.g., ZIP, ISO, or executables disguised as documents) or links to malicious websites are common. These often employ social engineering to trick users into executing the payload.
Exploit Kits: RedLine Stealer can be a secondary payload delivered by exploit kits that target vulnerabilities in web browsers or their plugins. While the prevalence of traditional exploit kits has decreased, they remain a vector.
Bundled Software/Cracked Applications: Malicious actors often bundle RedLine Stealer with pirated software, game cheats, or utility tools downloaded from untrusted sources.
Supply Chain Compromises: Though less common for RedLine specifically, compromised software updates or distribution channels can also serve as an entry point.

The initial execution often involves a disguised executable or a script that drops and executes the main RedLine binary. For instance, a common scenario involves an initial loader disguised as a legitimate application that then downloads and executes the RedLine Stealer payload.

Persistence Mechanisms

RedLine Stealer employs several techniques to maintain persistence across reboots:

Registry Run Keys: The malware often adds entries to HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run to ensure its execution upon user login or system startup.
```
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MalwareName" = "C:\Users\<User>\AppData\Roaming\<RandomName>.exe"
```
Scheduled Tasks: Creating scheduled tasks that run the malware at specific intervals or upon system startup is another common method. This provides a robust persistence mechanism.
```
schtasks /create /tn "MalwareTask" /tr "C:\Users\<User>\AppData\Roaming\<RandomName>.exe" /sc ONSTART /f
```
Startup Folder: Dropping a shortcut or the executable itself into the user's or system's startup folder can also establish persistence.

Command and Control (C2) Communication Protocol

RedLine Stealer typically communicates with its Command and Control (C2) server using the HTTP/HTTPS protocol. This choice offers several advantages:

Stealth: HTTP/HTTPS traffic blends in with legitimate web browsing, making it harder to detect with basic network monitoring.
Firewall Evasion: Standard ports (80, 443) are usually open in enterprise firewalls.
Data Format: Data is often encoded and sent as POST requests, with responses similarly formatted.

The communication pattern usually involves:

Initial Beacon: The stealer sends an initial beacon to the C2 server to report its presence and send basic system information.
Data Exfiltration: Stolen credentials and other sensitive data are uploaded in chunks, often compressed and encrypted.
Command Reception: The stealer listens for commands from the C2 server, which might include instructions to download additional payloads, execute commands, or perform further reconnaissance.

The protocol is generally a custom implementation over HTTP/S, often involving:

POST requests: Used for sending stolen data and system information.
GET requests: Used for receiving commands or additional payloads.
JSON or custom binary formats: For data transmission.
User-Agent strings: Often crafted to mimic legitimate browser User-Agents to blend in.

Payload Delivery and Staging Mechanism

RedLine Stealer often acts as a downloader or first-stage payload. Upon execution, it might:

Gather System Information: Collect details like username, hostname, operating system version, installed software, and hardware information.
Scan for Sensitive Data: Systematically search for files and data related to browsers (Chrome, Firefox, Edge), cryptocurrency wallets, FTP clients, VPNs, and other common applications. This search is typically localized to user profiles and common installation directories.
Exfiltrate Initial Data: Send the gathered system information and a list of found sensitive data targets to the C2.
Download Second Stage: Based on C2 instructions or pre-configured logic, it might download additional modules or a more advanced payload. This could include ransomware, a more sophisticated RAT (Remote Access Trojan), or further reconnaissance tools.

Privilege Escalation Steps

RedLine Stealer itself does not typically perform sophisticated privilege escalation. Its primary focus is on data theft from the context of the compromised user. However, if the initial infection occurs with low privileges, it may attempt basic privilege escalation if an opportunity presents itself through known, unpatched vulnerabilities. More commonly, any privilege escalation is achieved through the exploitation of vulnerabilities by a secondary payload delivered by RedLine.

Lateral Movement Techniques Used

RedLine Stealer's direct lateral movement capabilities are limited. Its design prioritizes data exfiltration from the initially compromised host. However, the stolen credentials (e.g., domain credentials, RDP credentials) can be used by threat actors to manually or automatically perform lateral movement using tools like PsExec or by exploiting RDP vulnerabilities. If RedLine is part of a larger attack chain, subsequent payloads might be responsible for lateral movement.

Data Exfiltration Methods

Data exfiltration is the core function of RedLine Stealer. It employs the following methods:

HTTP/HTTPS POST Requests: The primary method. Data is encoded (e.g., Base64, XOR) and sent to the C2 server.
Compression: To reduce network traffic, stolen data is often compressed (e.g., using zlib).
Encryption: Sensitive data might be encrypted using symmetric algorithms (e.g., AES) or a combination of public/private key cryptography to protect it during transit and storage.
Data Structures: The stealer organizes stolen data into specific formats (e.g., JSON payloads) before transmission.

The types of data targeted include:

Browser Credentials: Saved passwords, cookies, autofill data from Chrome, Firefox, Edge, Brave, Opera, etc.
Cryptocurrency Wallets: Seed phrases, private keys, and wallet files from various cryptocurrency applications.
FTP Clients: Credentials for FTP, SFTP, and FTPS clients (e.g., FileZilla, WinSCP).
VPN Clients: VPN configuration files and credentials.
System Information: OS version, CPU info, GPU info, installed security software, IP address.
Clipboard Content: Occasionally, it may monitor and exfiltrate clipboard contents.

Anti-Analysis / Anti-Debugging / Anti-VM Tricks

RedLine Stealer incorporates several techniques to evade detection and analysis:

Packing and Obfuscation: The main executable is often packed (e.g., using UPX or custom packers) to obfuscate its true nature. String encryption and obfuscated API calls are also common.
Anti-Debugging: Checks for the presence of debuggers (e.g., IsDebuggerPresent(), CheckRemoteDebuggerPresent()). If a debugger is detected, the malware might exit or behave differently.
Anti-VM/Anti-Sandbox: It may check for signs of a virtualized environment, such as specific registry keys, device names, or the presence of common sandbox tools. If detected, it may refuse to run or terminate.
Delayed Execution: Some variants might employ time-based delays to evade automated sandbox analysis that has a limited execution window.
Code Virtualization: Advanced variants might use code virtualization techniques to further obfuscate critical logic.

MITRE ATT&CK Full Mapping

Technique ID	Technique Name	Implementation	Detection
T1071.001	Application Layer Protocol: Web Protocols	RedLine Stealer communicates with its C2 server primarily over HTTP/HTTPS to exfiltrate stolen data and receive commands. This involves making POST requests to C2 domains.	Network Traffic Analysis: Monitor for unusual HTTP POST requests to known malicious domains or IPs, especially those with suspicious User-Agent strings or data payloads. Analyze traffic for common RedLine C2 patterns.
T1140	Deobfuscate/Decode Files or Information	The malware commonly uses string encryption and packing techniques. It decrypts strings at runtime to retrieve API function names, C2 URLs, or configuration data. Packers like UPX are also frequently employed.	Static Analysis: Use tools like PEiD or Detect It Easy to identify packers. Dynamic analysis with a debugger can reveal runtime decryption routines for strings and configurations.
T1059.003	Command and Scripting Interpreter: Windows Command Shell	While not its primary mechanism, RedLine Stealer can execute arbitrary commands received from the C2 server. This might involve using `cmd.exe` for basic operations.	Process Monitoring: Detect suspicious `cmd.exe` processes spawned by the stealer or that execute unusual commands. Monitor for commands related to reconnaissance or further payload execution.
T1059.001	Command and Scripting Interpreter: PowerShell	Some dropper or loader components of RedLine Stealer might utilize PowerShell for obfuscated execution or to download and launch the main payload.	PowerShell Logging: Enable PowerShell script block logging (Event ID 4104) and module logging (Event ID 4103) to capture and analyze suspicious PowerShell commands and execution flows.
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	RedLine Stealer commonly adds entries to Windows Registry Run keys (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`) or places executables/shortcuts in the Startup folder to ensure persistence.	Registry Monitoring: Monitor for new or modified entries in known Run keys. File System Monitoring: Detect executables or shortcuts being placed in the user or system Startup folders.
T1055.012	Process Injection: Process Hollowing	While less common for typical RedLine, more advanced variants or loaders might employ process hollowing to inject their malicious code into a legitimate process, making detection harder.	Process Monitoring: Detect unusual process creation events where a legitimate process (e.g., `explorer.exe`, `svchost.exe`) is created in a suspended state and then its memory is modified and resumed with malicious code.
T1560.001	Archive via Utility: Archive via Utility	RedLine Stealer often compresses the stolen data before exfiltrating it. This is typically done using built-in compression libraries rather than external utilities.	Network Traffic Analysis: Observe outbound network traffic that shows patterns of compressed data being sent, especially in conjunction with other suspicious activity.
T1552.001	Credentials From Password Stores	This is the core function of RedLine Stealer. It targets and extracts credentials from web browsers, FTP clients, email clients, and cryptocurrency wallets.	Endpoint Detection: Monitor for processes attempting to access sensitive credential storage locations (e.g., browser profile directories, wallet executables). Memory Analysis: Look for tools or processes attempting to dump LSASS memory or access specific browser/application data structures.
T1003.003	OS Credential Dumping: NTDS: T1003.003	While RedLine Stealer primarily targets application-level credentials, it can sometimes leverage tools or techniques to dump LSA secrets or hashes if it gains sufficient privileges.	Endpoint Detection: Monitor for suspicious access to `lsass.exe` memory, especially from unusual processes. Tools like Mimikatz or its derivatives are often flagged.
T1110	Brute Force	RedLine Stealer itself doesn't perform brute-forcing. However, the credentials it steals can be used by attackers for brute-force attacks against other systems or services.	Authentication Monitoring: Monitor for a high volume of failed login attempts against critical systems. Network Monitoring: Detect unusual login patterns originating from compromised endpoints.
T1041	Exfiltration Over C2 Channel	RedLine Stealer uploads all collected sensitive information to its C2 server over the established HTTP/HTTPS communication channel.	Network Traffic Analysis: Analyze outbound traffic for large POST requests to C2 infrastructure, especially if containing compressed or encoded data. Monitor for traffic patterns consistent with RedLine's exfiltration methods.
T1033	System Owner/User Discovery	The stealer collects information about the current user, including username and potentially user SID, to personalize its exfiltration data.	Process Monitoring: Observe processes that query user information or enumerate user accounts.

Indicators of Compromise (IOCs)

File Hashes (SHA256 / MD5 / SHA1)

SHA256: 6c3504d357f983b78526bfc54743a143e10a5ee781427a3e052b911aa459bb27
- MD5: 7f2f87430340fcd440f9244ca81516d6
- Type: sh | Size: 45432B
SHA256: 710c7947aaf56ec90c8f58f1d21f2f5b2f3753ff8266ba3ca3abcdfeacd080b9
- MD5: 942fddad7fced507ff75e70a5449b8be
- Type: exe | Size: 1152512B
SHA256: 88ede6debb9c5abe10956e84451d265aeda339842ccf8ed151d131425d5ecb58
- MD5: e4b4a322dc873efe6e2ce6a0e44b5bd4
- Type: unknown | Size: 474B
SHA256: f1eadb3d345839b46d7ccdfc156c52a770ec123b4e2b6cde97152be11241b3b4
- MD5: ac5841e8b08eab0c6691bfa81c7fac81
- Type: exe | Size: 1933824B
SHA256: 6128325a4fe32866304f16d41d991bd22c19c49f7441293a9494999e91b8809c
- MD5: de9546b3ab4c8736a66aa9541ae62c4b
- Type: 7z | Size: 24885390B

Network Indicators

C2 Domains/IPs: (These change frequently; monitor threat intelligence feeds for current ones.)
- Example: hxxp://[IP_ADDRESS]/gate.php
- Example: hxxps://[DOMAIN]/panel/gate.php
Ports: 80 (HTTP), 443 (HTTPS)
HTTP/S Beacon Patterns:
- POST requests to /gate.php, /panel/gate.php, or similar endpoints.
- Requests often contain encoded payloads in the body.
- User-Agent strings mimicking legitimate browsers (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/XX.X.XXXX.XX Safari/537.36).
URL Patterns:
- /gate.php
- /panel/
- Randomized paths or subdomains.

Registry Keys / File Paths / Mutex

Persistence Registry Keys:
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
- HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
- HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Dropped File Paths:
- C:\Users\<User>\AppData\Roaming\<RandomName>.exe
- C:\Users\<User>\AppData\Local\<RandomName>.exe
- C:\ProgramData\<RandomName>.exe
Mutex Names: Often randomly generated GUIDs or simple descriptive strings. Example: Global\Mutex_{GUID}.

YARA Rule

rule RedLineStealer_Generic {
    meta:
        description = "Detects generic characteristics of RedLine Stealer"
        author = "Malware Analyst"
        date = "2026-04-26"
        version = "1.1"
        malware_family = "RedLine Stealer"
        reference = "MalwareBazaar, VT"
        hash = "6c3504d357f983b78526bfc54743a143e10a5ee781427a3e052b911aa459bb27" // Example hash for context
        hash_2 = "710c7947aaf56ec90c8f58f1d21f2f5b2f3753ff8266ba3ca3abcdfeacd080b9" // Example hash for context

    strings:
        // Common strings related to data theft targets
        $s1 = "Login Data" wide ascii
        $s2 = "Cookies" wide ascii
        $s3 = "History" wide ascii
        $s4 = "Wallet" wide ascii
        $s5 = "FileZilla" wide ascii
        $s6 = "WinSCP" wide ascii
        $s7 = "NordVPN" wide ascii
        $s8 = "OpenVPN" wide ascii
        $s9 = "Chrome" wide ascii
        $s10 = "Firefox" wide ascii
        $s11 = "Edge" wide ascii
        $s12 = "Opera" wide ascii
        $s13 = "Brave" wide ascii

        // Potential C2 communication patterns
        $s14 = "/gate.php" ascii
        $s15 = "POST" ascii // Common HTTP method for exfiltration
        $s16 = "User-Agent" ascii // Often present in HTTP headers

        // Persistence related strings
        $s17 = "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
        $s18 = "\\AppData\\Roaming\\" ascii // Common dropped location

        // Anti-analysis related strings (may vary)
        $s19 = "IsDebuggerPresent" ascii // Windows API call
        $s20 = "CheckRemoteDebuggerPresent" ascii // Windows API call

    condition:
        // High confidence: presence of multiple strings related to data targets and C2 patterns
        (
            (uint16(0) == 0x5A4D) and // PE file header check
            (
                2 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8, $s9, $s10, $s11, $s12, $s13) and
                1 of ($s14, $s15, $s16)
            )
        ) or
        // Medium confidence: presence of persistence and data target strings
        (
            (uint16(0) == 0x5A4D) and
            3 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8, $s9, $s10, $s11, $s12, $s13) and
            1 of ($s17, $s18)
        ) or
        // Low confidence: presence of anti-analysis and C2 patterns
        (
            (uint16(0) == 0x5A4D) and
            1 of ($s19, $s20) and
            1 of ($s14, $s15, $s16)
        )
}

Static Analysis — Anatomy of the Binary

A typical RedLine Stealer binary, when unpacked, reveals a .NET or C++ compiled executable.

File Structure and PE Headers: Standard Windows Portable Executable (PE) format. The Optional Header contains information about the entry point, image base, and sections. Common sections include .text (code), .data (initialized data), .rdata (read-only data), and .reloc (relocations).
Obfuscation and Packing Techniques:
- UPX Packer: Very common. UPX can be easily unpacked using standard tools, revealing the underlying .NET or native code.
- String Encryption: Critical strings like C2 URLs, API function names, and configuration parameters are often encrypted using algorithms like XOR or AES. These are decrypted at runtime.
- API Hashing: Instead of directly importing API functions, RedLine might resolve them dynamically by hashing their names and searching the loaded modules. This obfuscates the import table.
Interesting Strings and Functions:
- Strings related to browser profiles (\Google\Chrome\User Data\Default\Login Data, \Mozilla\Firefox\Profiles\*.default\cookies.sqlite).
- Strings related to wallet files (e.g., wallet.dat).
- API function names (often obfuscated or hashed): CreateFileA, WriteFile, ReadFile, RegOpenKeyExA, RegQueryValueExA, HttpOpenRequestA, HttpSendRequestA, InternetConnectA, GetUserNameA, GetComputerNameA, CryptStringToBinaryA, CryptBinaryToStringA.
- The presence of .NET assemblies indicates a managed code component, often used for easier string manipulation and network communication.
Import Table Analysis: The import table of a packed binary will be minimal. After unpacking, it might show imports for kernel32.dll, user32.dll, advapi32.dll, wininet.dll, and crypt32.dll. Dynamic API resolution bypasses a static import table analysis.
Embedded Resources or Second-Stage Payloads: Some variants may embed configuration data or even encrypted second-stage payloads within their resources section. These are decrypted and loaded into memory at runtime.

Dynamic Analysis — Behavioral Profile

Dynamic analysis reveals the runtime activities of RedLine Stealer, providing crucial behavioral indicators.

File System Activity:
- Creates its executable in %AppData% or %ProgramData%.
- May create temporary files for staging data.
- Accesses browser profile directories (e.g., C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\Login Data, C:\Users\<User>\AppData\Roaming\Mozilla\Firefox\Profiles\<ProfileName>\cookies.sqlite).
- Accesses cryptocurrency wallet directories.
Registry Activity:
- Writes entries to HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
- Queries registry keys related to installed software and system configuration.
Network Activity:
- Initiates HTTP/HTTPS connections to C2 servers.
- Sends POST requests containing encoded data (system info, credentials).
- Receives commands or additional payloads via HTTP/HTTPS GET requests.
- Beaconing intervals can vary, often between 30 seconds to several minutes.
- Wireshark/tcpdump Capture Patterns: Look for outbound TCP connections on ports 80/443 to suspicious IPs/domains. Analyze the POST requests for unusual User-Agent strings and large, potentially encoded or compressed data payloads. Lack of SNI in HTTPS traffic might be a subtle indicator of non-browser traffic, though many RedLine variants use HTTPS.
Process Activity:
- May spawn cmd.exe or powershell.exe for specific tasks, though often it performs actions directly.
- If a loader is used, it might inject into legitimate processes (e.g., explorer.exe, svchost.exe).
Memory Artifacts:
- Decrypted strings related to targets and C2 infrastructure in memory.
- Injected code segments if process injection is used.
- Raw data buffers containing stolen credentials before encryption and exfiltration.

Real-World Attack Campaigns

RedLine Stealer has been a consistent player in the cybercrime landscape. Documented campaigns often highlight its role as a readily available tool for various threat actors.

Broad Phishing Campaigns (Ongoing): Numerous campaigns distribute RedLine Stealer via emails containing malicious attachments (e.g., fake invoices, shipping notifications) or links to download sites disguised as software repositories. Victimology is broad, encompassing individuals and small to medium-sized businesses across various sectors, primarily in North America and Europe. The impact is direct financial loss through credential theft and cryptocurrency theft.
Bundled with Pirated Software (Frequent): RedLine Stealer is frequently found bundled with cracked software, game cheats, and utility tools advertised on forums and websites. Users downloading such content unknowingly install the stealer. This campaign targets gamers, software developers, and general users seeking free software, primarily in regions with higher rates of software piracy.
Exploit Kit Payloads (Historical/Declining): In earlier stages, RedLine Stealer was observed as a secondary payload delivered by exploit kits targeting vulnerabilities in browsers and plugins. These campaigns were widespread, affecting users who visited compromised websites. While less prevalent now, this vector still poses a risk.
Targeted Data Theft Operations (Less Common but Possible): While RedLine is a commodity stealer, sophisticated actors might use it as a reconnaissance tool or initial access vector in more targeted attacks, leveraging its ability to quickly gather credentials that can be used for further lateral movement or privilege escalation.

Active Malware Landscape — Context

RedLine Stealer is a prominent example of the "Malware-as-a-Service" (MaaS) model in the information stealer domain.

Current Prevalence and Activity Level: RedLine Stealer remains highly active. Recent data from MalwareBazaar and VirusTotal consistently shows new samples being uploaded and detected daily. Its availability on underground forums as a cheap or even free (in some cases, for specific versions) tool ensures its widespread adoption by various cybercriminals.
Competing or Related Malware Families: RedLine competes with other popular information stealers such as Raccoon Stealer, Vidar Stealer, Agent Tesla, and HawkEye Keylogger. These families often share similar functionalities and distribution methods.
Relationship to Ransomware-as-a-Service (RaaS) or Malware-as-a-Service (MaaS): RedLine Stealer is a prime example of MaaS. Its developers likely sell access to the malware or its control panel, or provide it as a service to other cybercriminals. The stolen credentials are a valuable commodity that can be used to gain initial access for ransomware deployment, further phishing, or direct financial fraud.
Typical Target Industries and Geographic Distribution: RedLine Stealer is not typically nation-state targeted but rather aims for broad compromise for financial gain. Its targets are therefore diverse, including individuals, small businesses, and larger enterprises across all sectors. Geographically, it has a global reach, with significant activity observed in North America, Europe, Asia, and South America.

Detection & Hunting

Sigma Rules

title: RedLine Stealer - Suspicious Registry Run Key Persistence
id: 2345a1b2-c3d4-5e6f-7890-1234567890ab
status: experimental
description: Detects the creation of a new registry Run key entry for persistence, a common tactic used by RedLine Stealer.
author: Malware Analyst
date: 2026/04/26
logsource:
    product: windows
    service: sysmon
detection:
    selection_registry:
        EventID: 12 # RegistryEvent
        TargetObject|startswith: 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run\'
        TargetObject|contains: '\' # Ensure it's a key, not the root
    selection_process:
        EventID: 1 # ProcessCreate
        Image|endswith:
            - '.exe'
            - '.dll' # Though less common for direct execution, can be loaded
        # We are looking for processes that are NOT standard system processes,
        # creating persistence. This is a heuristic.
        Image|endswith:
            - 'cmd.exe'
            - 'powershell.exe'
            - '.exe'
    filter_legit_processes:
        Image|endswith:
            - 'svchost.exe'
            - 'explorer.exe'
            - 'regedit.exe'
            - 'msiexec.exe'
            - 'wermgr.exe'
            - 'smartscreen.exe'
            - 'backgroundtaskhost.exe'
            - 'ctfmon.exe'
            - 'spoolsv.exe'
            - 'fontdrvhost.exe'
            - 'taskeng.exe'
            - 'wuauclt.exe'
            - 'browserprocess.exe' # For Edge
            - 'chrome.exe' # Might be legitimate, but context is key
            - 'firefox.exe' # Might be legitimate, but context is key
    condition: selection_registry and selection_process and not filter_legit_processes
fields:
    - Computer
    - User
    - Image
    - CommandLine
    - TargetObject
    - Details
tags:
    - attack.persistence
    - attack.t1547.001
    - malware.redline

title: RedLine Stealer - Suspicious Network Beacon with Common User Agent
id: fedcba98-7654-3210-fedc-ba9876543210
status: experimental
description: Detects outbound HTTP POST requests with User-Agent strings commonly used by RedLine Stealer, targeting specific paths like '/gate.php'.
author: Malware Analyst
date: 2026/04/26
logsource:
    product: windows
    service: sysmon
detection:
    selection_network:
        EventID: 3 # NetworkConnection
        Protocol: 6 # TCP
        DestinationPort: 80 or 443
    selection_http_method:
        # This requires HTTP logging, usually from a proxy or advanced EDR.
        # If only Sysmon network logs are available, this part is indicative.
        # Assuming a proxy logs HTTP details or EDR can parse this.
        HttpRequest.HttpMethod: "POST"
    selection_path:
        HttpRequest.Url|contains: '/gate.php'
    selection_user_agent:
        HttpRequest.UserAgent:
            - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/*'
            - 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/*'
            - 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/*'
            # Add other common browser UAs if observed
    condition: selection_network and selection_http_method and selection_path and selection_user_agent
fields:
    - Computer
    - User
    - Image
    - DestinationIp
    - DestinationPort
    - HttpRequest.Url
    - HttpRequest.UserAgent
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1071.001
    - malware.redline

EDR / SIEM Detection Logic

Process Tree Anomalies:
- Detect mshta.exe or wscript.exe/cscript.exe processes spawning cmd.exe or powershell.exe with obfuscated or encoded commands.
- Monitor for suspicious process creations where the executable path is unusual (e.g., AppData\Roaming, %TEMP%).
- Detect processes with unusual parent-child relationships, such as a Word document spawning cmd.exe.
Network Communication Patterns:
- Alert on HTTP/HTTPS POST requests to unusual or newly registered domains, especially those with /gate.php or similar patterns in the URL.
- Monitor for connections to known malicious C2 IPs or domains associated with RedLine Stealer.
- Track User-Agent strings that mimic browsers but originate from non-browser processes.
File System Telemetry Triggers:
- Alert on executables being dropped into AppData\Roaming, AppData\Local, or %TEMP% directories.
- Monitor for access to sensitive browser profile directories (e.g., Login Data, cookies.sqlite, logins.json) by non-browser processes.
- Detect creation of new entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run by non-system processes.
Registry Activity Patterns:
- Alert on suspicious modifications to Run keys.
- Monitor for registry queries related to installed software that might indicate reconnaissance for credential harvesting.

Memory Forensics

# Volatility3 detection commands

# Dump process memory for analysis of strings and artifacts
# Replace <PID> with the process ID of the suspicious process
vol -f <memory_image_path> windows.memmap.Memmap --pid <PID> -o memory_dump.bin

# Extract strings from a process dump
strings memory_dump.bin | grep -iE "gate\.php|Login Data|Cookies|Wallet|Firefox|Chrome|OpenVPN|WinSCP|FileZilla"

# Identify .NET processes and extract their memory
# Useful if RedLine is a .NET binary
vol -f <memory_image_path> windows.dotnet.Dump -o /tmp/dotnet_dumps/

# Look for suspicious DLLs loaded into processes
vol -f <memory_image_path> windows.dlllist.DllList --pid <PID>

# Uncover hidden processes (if the malware attempts to hide itself)
vol -f <memory_image_path> windows.pslist.PsList --hidden

# Analyze network connections from processes
vol -f <memory_image_path> windows.netscan.NetScan

# Search for specific API calls or code patterns within process memory (requires more advanced analysis or plugins)
# Example: Searching for common encryption/decryption API calls if known
# vol -f <memory_image_path> windows.malfind.Malfind --pid <PID>

Malware Removal & Incident Response

Isolation Procedures: Immediately isolate the affected endpoint from the network to prevent lateral movement and further C2 communication. This can be achieved by disabling the network adapter or using host-based firewall rules.
Artifact Identification and Collection: Collect volatile data (running processes, network connections, loaded DLLs, command history) and non-volatile data (executables, configuration files, registry entries, logs). Use forensic tools to create a disk image for deeper analysis.
Registry and File System Cleanup:
- Remove persistence mechanisms: Delete entries from HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
- Delete scheduled tasks created by the malware.
- Remove dropped executables from common locations (%AppData%, %ProgramData%, %TEMP%).
- Clean up any created mutexes.
Network Block Recommendations: Block known RedLine Stealer C2 IPs and domains at the firewall and DNS level. Update intrusion detection/prevention systems (IDS/IPS) with relevant signatures.
Password Reset Scope: Advise users to reset passwords for all accounts whose credentials might have been stored on the compromised machine, especially web browsers, FTP clients, VPNs, and cryptocurrency wallets. Consider a broader password reset policy if domain credentials are suspected to be compromised.

Defensive Hardening

Specific Group Policy Settings:
- Disable mshta.exe execution: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> HTML Applications -> Disable HTML Applications (Set to Enabled). This mitigates a common initial execution vector.
- Enable PowerShell Script Block Logging: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Windows PowerShell -> Turn on PowerShell Script Block Logging (Set to Enabled).
- Restrict regedit.exe execution: Use AppLocker or Software Restriction Policies to limit regedit.exe execution to trusted administrators.
Firewall Rule Examples:
- Outbound Block: Block outbound TCP traffic on ports 80 and 443 to known RedLine C2 IPs or domains.
- Inbound Block: Ensure no unnecessary inbound ports are open, especially for RDP (3389) unless strictly required and secured.
Application Whitelist Approach: Implement application whitelisting (e.g., using AppLocker or Windows Defender Application Control) to only allow known, trusted applications to run. This significantly reduces the risk of executing unknown malware.
EDR Telemetry Tuning: Ensure your EDR solution is configured to collect detailed process creation, network connection, registry, and file system events. Tune detection rules to minimize false positives while maximizing coverage for RedLine's TTPs. Prioritize behavioral analytics over signature-based detection for evolving threats like RedLine.
Network Segmentation Recommendation: Implement network segmentation to limit the blast radius of a compromise. Critical servers and sensitive data stores should be isolated from user workstations and less trusted network segments.

References

MalwareBazaar: https://bazaar.abuse.ch/browse.php?search=RedLine%20Stealer
VirusTotal: https://www.virustotal.com/
OTX AlienVault: https://otx.alienvault.com/
MITRE ATT&CK: https://attack.mitre.org/

This report detailed the capabilities of RedLine Stealer, a persistent threat in the malware landscape. We examined its infection vectors, persistence mechanisms, C2 communication, and data exfiltration methods, providing a deep technical understanding. The mapping to MITRE ATT&CK techniques, along with actionable IOCs, YARA rules, Sigma rules, and EDR/SIEM detection logic, offers practical guidance for defenders. By understanding the anatomy of this information stealer and implementing robust defensive hardening measures, organizations can better detect, prevent, and respond to RedLine Stealer attacks, protecting critical assets and sensitive data.

By ZeroDay Malware Intelligence•April 26, 2026•

malware

REDLINE STEALER Malware Analysis: MITRE ATT&CK, IOCs & Detection

title: "REDLINE STEALER Malware Analysis: MITRE ATT&CK, IOCs & Detection"
description: "Complete technical analysis of RedLine Stealer — detection ratio N/A, MITRE ATT&CK mapping, IOCs, behavioral profile, YARA rules, and incident response. Enriched by AI with live MalwareBazaar and OTX data."
date: "2026-04-26"
category: malware
image: "/img/posts/malware.png"
tags: ["malware", "threat-intelligence", "mitre-attck", "redline-stealer", "redline stealer", "ioc", "detection", "cybersecurity"]
author: "ZeroDay Malware Intelligence"
malwareFamily: "RedLine Stealer"
malwareType: "RedLine Stealer"
detectRatio: "N/A"
attackTechniquesCount: "0"

REDLINE STEALER Malware Analysis: MITRE ATT&CK, IOCs & Detection

Detection ratio: N/A | MITRE ATT&CK techniques: see below | Type: RedLine Stealer | Updated: 2026-04-26

This analysis was auto-enriched using live MalwareBazaar samples, VirusTotal reports, and OTX AlienVault threat intelligence, then synthesized and expanded by Ibugsec Corp.

RedLine Stealer: A Deep Dive into a Modern Information Stealer

Executive Summary

How It Works — Technical Deep Dive

RedLine Stealer's operational lifecycle involves several stages, from initial compromise to data exfiltration. Understanding each phase is crucial for effective detection and remediation.

Initial Infection Vector

RedLine Stealer is typically delivered through one of the following methods:

Phishing Campaigns: Malicious email attachments (e.g., ZIP, ISO, or executables disguised as documents) or links to malicious websites are common. These often employ social engineering to trick users into executing the payload.
Exploit Kits: RedLine Stealer can be a secondary payload delivered by exploit kits that target vulnerabilities in web browsers or their plugins. While the prevalence of traditional exploit kits has decreased, they remain a vector.
Bundled Software/Cracked Applications: Malicious actors often bundle RedLine Stealer with pirated software, game cheats, or utility tools downloaded from untrusted sources.
Supply Chain Compromises: Though less common for RedLine specifically, compromised software updates or distribution channels can also serve as an entry point.

Persistence Mechanisms

RedLine Stealer employs several techniques to maintain persistence across reboots:

Registry Run Keys: The malware often adds entries to HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run to ensure its execution upon user login or system startup.
```
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MalwareName" = "C:\Users\<User>\AppData\Roaming\<RandomName>.exe"
```
Scheduled Tasks: Creating scheduled tasks that run the malware at specific intervals or upon system startup is another common method. This provides a robust persistence mechanism.
```
schtasks /create /tn "MalwareTask" /tr "C:\Users\<User>\AppData\Roaming\<RandomName>.exe" /sc ONSTART /f
```
Startup Folder: Dropping a shortcut or the executable itself into the user's or system's startup folder can also establish persistence.

Command and Control (C2) Communication Protocol

RedLine Stealer typically communicates with its Command and Control (C2) server using the HTTP/HTTPS protocol. This choice offers several advantages:

Stealth: HTTP/HTTPS traffic blends in with legitimate web browsing, making it harder to detect with basic network monitoring.
Firewall Evasion: Standard ports (80, 443) are usually open in enterprise firewalls.
Data Format: Data is often encoded and sent as POST requests, with responses similarly formatted.

The communication pattern usually involves:

Initial Beacon: The stealer sends an initial beacon to the C2 server to report its presence and send basic system information.
Data Exfiltration: Stolen credentials and other sensitive data are uploaded in chunks, often compressed and encrypted.
Command Reception: The stealer listens for commands from the C2 server, which might include instructions to download additional payloads, execute commands, or perform further reconnaissance.

The protocol is generally a custom implementation over HTTP/S, often involving:

POST requests: Used for sending stolen data and system information.
GET requests: Used for receiving commands or additional payloads.
JSON or custom binary formats: For data transmission.
User-Agent strings: Often crafted to mimic legitimate browser User-Agents to blend in.

Payload Delivery and Staging Mechanism

RedLine Stealer often acts as a downloader or first-stage payload. Upon execution, it might:

Gather System Information: Collect details like username, hostname, operating system version, installed software, and hardware information.
Scan for Sensitive Data: Systematically search for files and data related to browsers (Chrome, Firefox, Edge), cryptocurrency wallets, FTP clients, VPNs, and other common applications. This search is typically localized to user profiles and common installation directories.
Exfiltrate Initial Data: Send the gathered system information and a list of found sensitive data targets to the C2.
Download Second Stage: Based on C2 instructions or pre-configured logic, it might download additional modules or a more advanced payload. This could include ransomware, a more sophisticated RAT (Remote Access Trojan), or further reconnaissance tools.

Privilege Escalation Steps

Lateral Movement Techniques Used

Data Exfiltration Methods

Data exfiltration is the core function of RedLine Stealer. It employs the following methods:

HTTP/HTTPS POST Requests: The primary method. Data is encoded (e.g., Base64, XOR) and sent to the C2 server.
Compression: To reduce network traffic, stolen data is often compressed (e.g., using zlib).
Encryption: Sensitive data might be encrypted using symmetric algorithms (e.g., AES) or a combination of public/private key cryptography to protect it during transit and storage.
Data Structures: The stealer organizes stolen data into specific formats (e.g., JSON payloads) before transmission.

The types of data targeted include:

Browser Credentials: Saved passwords, cookies, autofill data from Chrome, Firefox, Edge, Brave, Opera, etc.
Cryptocurrency Wallets: Seed phrases, private keys, and wallet files from various cryptocurrency applications.
FTP Clients: Credentials for FTP, SFTP, and FTPS clients (e.g., FileZilla, WinSCP).
VPN Clients: VPN configuration files and credentials.
System Information: OS version, CPU info, GPU info, installed security software, IP address.
Clipboard Content: Occasionally, it may monitor and exfiltrate clipboard contents.

Anti-Analysis / Anti-Debugging / Anti-VM Tricks

RedLine Stealer incorporates several techniques to evade detection and analysis:

Packing and Obfuscation: The main executable is often packed (e.g., using UPX or custom packers) to obfuscate its true nature. String encryption and obfuscated API calls are also common.
Anti-Debugging: Checks for the presence of debuggers (e.g., IsDebuggerPresent(), CheckRemoteDebuggerPresent()). If a debugger is detected, the malware might exit or behave differently.
Anti-VM/Anti-Sandbox: It may check for signs of a virtualized environment, such as specific registry keys, device names, or the presence of common sandbox tools. If detected, it may refuse to run or terminate.
Delayed Execution: Some variants might employ time-based delays to evade automated sandbox analysis that has a limited execution window.
Code Virtualization: Advanced variants might use code virtualization techniques to further obfuscate critical logic.

MITRE ATT&CK Full Mapping

Technique ID	Technique Name	Implementation	Detection
T1071.001	Application Layer Protocol: Web Protocols	RedLine Stealer communicates with its C2 server primarily over HTTP/HTTPS to exfiltrate stolen data and receive commands. This involves making POST requests to C2 domains.	Network Traffic Analysis: Monitor for unusual HTTP POST requests to known malicious domains or IPs, especially those with suspicious User-Agent strings or data payloads. Analyze traffic for common RedLine C2 patterns.
T1140	Deobfuscate/Decode Files or Information	The malware commonly uses string encryption and packing techniques. It decrypts strings at runtime to retrieve API function names, C2 URLs, or configuration data. Packers like UPX are also frequently employed.	Static Analysis: Use tools like PEiD or Detect It Easy to identify packers. Dynamic analysis with a debugger can reveal runtime decryption routines for strings and configurations.
T1059.003	Command and Scripting Interpreter: Windows Command Shell	While not its primary mechanism, RedLine Stealer can execute arbitrary commands received from the C2 server. This might involve using `cmd.exe` for basic operations.	Process Monitoring: Detect suspicious `cmd.exe` processes spawned by the stealer or that execute unusual commands. Monitor for commands related to reconnaissance or further payload execution.
T1059.001	Command and Scripting Interpreter: PowerShell	Some dropper or loader components of RedLine Stealer might utilize PowerShell for obfuscated execution or to download and launch the main payload.	PowerShell Logging: Enable PowerShell script block logging (Event ID 4104) and module logging (Event ID 4103) to capture and analyze suspicious PowerShell commands and execution flows.
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	RedLine Stealer commonly adds entries to Windows Registry Run keys (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`) or places executables/shortcuts in the Startup folder to ensure persistence.	Registry Monitoring: Monitor for new or modified entries in known Run keys. File System Monitoring: Detect executables or shortcuts being placed in the user or system Startup folders.
T1055.012	Process Injection: Process Hollowing	While less common for typical RedLine, more advanced variants or loaders might employ process hollowing to inject their malicious code into a legitimate process, making detection harder.	Process Monitoring: Detect unusual process creation events where a legitimate process (e.g., `explorer.exe`, `svchost.exe`) is created in a suspended state and then its memory is modified and resumed with malicious code.
T1560.001	Archive via Utility: Archive via Utility	RedLine Stealer often compresses the stolen data before exfiltrating it. This is typically done using built-in compression libraries rather than external utilities.	Network Traffic Analysis: Observe outbound network traffic that shows patterns of compressed data being sent, especially in conjunction with other suspicious activity.
T1552.001	Credentials From Password Stores	This is the core function of RedLine Stealer. It targets and extracts credentials from web browsers, FTP clients, email clients, and cryptocurrency wallets.	Endpoint Detection: Monitor for processes attempting to access sensitive credential storage locations (e.g., browser profile directories, wallet executables). Memory Analysis: Look for tools or processes attempting to dump LSASS memory or access specific browser/application data structures.
T1003.003	OS Credential Dumping: NTDS: T1003.003	While RedLine Stealer primarily targets application-level credentials, it can sometimes leverage tools or techniques to dump LSA secrets or hashes if it gains sufficient privileges.	Endpoint Detection: Monitor for suspicious access to `lsass.exe` memory, especially from unusual processes. Tools like Mimikatz or its derivatives are often flagged.
T1110	Brute Force	RedLine Stealer itself doesn't perform brute-forcing. However, the credentials it steals can be used by attackers for brute-force attacks against other systems or services.	Authentication Monitoring: Monitor for a high volume of failed login attempts against critical systems. Network Monitoring: Detect unusual login patterns originating from compromised endpoints.
T1041	Exfiltration Over C2 Channel	RedLine Stealer uploads all collected sensitive information to its C2 server over the established HTTP/HTTPS communication channel.	Network Traffic Analysis: Analyze outbound traffic for large POST requests to C2 infrastructure, especially if containing compressed or encoded data. Monitor for traffic patterns consistent with RedLine's exfiltration methods.
T1033	System Owner/User Discovery	The stealer collects information about the current user, including username and potentially user SID, to personalize its exfiltration data.	Process Monitoring: Observe processes that query user information or enumerate user accounts.

Indicators of Compromise (IOCs)

File Hashes (SHA256 / MD5 / SHA1)

SHA256: 6c3504d357f983b78526bfc54743a143e10a5ee781427a3e052b911aa459bb27
- MD5: 7f2f87430340fcd440f9244ca81516d6
- Type: sh | Size: 45432B
SHA256: 710c7947aaf56ec90c8f58f1d21f2f5b2f3753ff8266ba3ca3abcdfeacd080b9
- MD5: 942fddad7fced507ff75e70a5449b8be
- Type: exe | Size: 1152512B
SHA256: 88ede6debb9c5abe10956e84451d265aeda339842ccf8ed151d131425d5ecb58
- MD5: e4b4a322dc873efe6e2ce6a0e44b5bd4
- Type: unknown | Size: 474B
SHA256: f1eadb3d345839b46d7ccdfc156c52a770ec123b4e2b6cde97152be11241b3b4
- MD5: ac5841e8b08eab0c6691bfa81c7fac81
- Type: exe | Size: 1933824B
SHA256: 6128325a4fe32866304f16d41d991bd22c19c49f7441293a9494999e91b8809c
- MD5: de9546b3ab4c8736a66aa9541ae62c4b
- Type: 7z | Size: 24885390B

Network Indicators

C2 Domains/IPs: (These change frequently; monitor threat intelligence feeds for current ones.)
- Example: hxxp://[IP_ADDRESS]/gate.php
- Example: hxxps://[DOMAIN]/panel/gate.php
Ports: 80 (HTTP), 443 (HTTPS)
HTTP/S Beacon Patterns:
- POST requests to /gate.php, /panel/gate.php, or similar endpoints.
- Requests often contain encoded payloads in the body.
- User-Agent strings mimicking legitimate browsers (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/XX.X.XXXX.XX Safari/537.36).
URL Patterns:
- /gate.php
- /panel/
- Randomized paths or subdomains.

Registry Keys / File Paths / Mutex

Persistence Registry Keys:
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
- HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
- HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
Dropped File Paths:
- C:\Users\<User>\AppData\Roaming\<RandomName>.exe
- C:\Users\<User>\AppData\Local\<RandomName>.exe
- C:\ProgramData\<RandomName>.exe
Mutex Names: Often randomly generated GUIDs or simple descriptive strings. Example: Global\Mutex_{GUID}.

YARA Rule

rule RedLineStealer_Generic {
    meta:
        description = "Detects generic characteristics of RedLine Stealer"
        author = "Malware Analyst"
        date = "2026-04-26"
        version = "1.1"
        malware_family = "RedLine Stealer"
        reference = "MalwareBazaar, VT"
        hash = "6c3504d357f983b78526bfc54743a143e10a5ee781427a3e052b911aa459bb27" // Example hash for context
        hash_2 = "710c7947aaf56ec90c8f58f1d21f2f5b2f3753ff8266ba3ca3abcdfeacd080b9" // Example hash for context

    strings:
        // Common strings related to data theft targets
        $s1 = "Login Data" wide ascii
        $s2 = "Cookies" wide ascii
        $s3 = "History" wide ascii
        $s4 = "Wallet" wide ascii
        $s5 = "FileZilla" wide ascii
        $s6 = "WinSCP" wide ascii
        $s7 = "NordVPN" wide ascii
        $s8 = "OpenVPN" wide ascii
        $s9 = "Chrome" wide ascii
        $s10 = "Firefox" wide ascii
        $s11 = "Edge" wide ascii
        $s12 = "Opera" wide ascii
        $s13 = "Brave" wide ascii

        // Potential C2 communication patterns
        $s14 = "/gate.php" ascii
        $s15 = "POST" ascii // Common HTTP method for exfiltration
        $s16 = "User-Agent" ascii // Often present in HTTP headers

        // Persistence related strings
        $s17 = "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
        $s18 = "\\AppData\\Roaming\\" ascii // Common dropped location

        // Anti-analysis related strings (may vary)
        $s19 = "IsDebuggerPresent" ascii // Windows API call
        $s20 = "CheckRemoteDebuggerPresent" ascii // Windows API call

    condition:
        // High confidence: presence of multiple strings related to data targets and C2 patterns
        (
            (uint16(0) == 0x5A4D) and // PE file header check
            (
                2 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8, $s9, $s10, $s11, $s12, $s13) and
                1 of ($s14, $s15, $s16)
            )
        ) or
        // Medium confidence: presence of persistence and data target strings
        (
            (uint16(0) == 0x5A4D) and
            3 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8, $s9, $s10, $s11, $s12, $s13) and
            1 of ($s17, $s18)
        ) or
        // Low confidence: presence of anti-analysis and C2 patterns
        (
            (uint16(0) == 0x5A4D) and
            1 of ($s19, $s20) and
            1 of ($s14, $s15, $s16)
        )
}

Static Analysis — Anatomy of the Binary

A typical RedLine Stealer binary, when unpacked, reveals a .NET or C++ compiled executable.

File Structure and PE Headers: Standard Windows Portable Executable (PE) format. The Optional Header contains information about the entry point, image base, and sections. Common sections include .text (code), .data (initialized data), .rdata (read-only data), and .reloc (relocations).
Obfuscation and Packing Techniques:
- UPX Packer: Very common. UPX can be easily unpacked using standard tools, revealing the underlying .NET or native code.
- String Encryption: Critical strings like C2 URLs, API function names, and configuration parameters are often encrypted using algorithms like XOR or AES. These are decrypted at runtime.
- API Hashing: Instead of directly importing API functions, RedLine might resolve them dynamically by hashing their names and searching the loaded modules. This obfuscates the import table.
Interesting Strings and Functions:
- Strings related to browser profiles (\Google\Chrome\User Data\Default\Login Data, \Mozilla\Firefox\Profiles\*.default\cookies.sqlite).
- Strings related to wallet files (e.g., wallet.dat).
- API function names (often obfuscated or hashed): CreateFileA, WriteFile, ReadFile, RegOpenKeyExA, RegQueryValueExA, HttpOpenRequestA, HttpSendRequestA, InternetConnectA, GetUserNameA, GetComputerNameA, CryptStringToBinaryA, CryptBinaryToStringA.
- The presence of .NET assemblies indicates a managed code component, often used for easier string manipulation and network communication.
Import Table Analysis: The import table of a packed binary will be minimal. After unpacking, it might show imports for kernel32.dll, user32.dll, advapi32.dll, wininet.dll, and crypt32.dll. Dynamic API resolution bypasses a static import table analysis.
Embedded Resources or Second-Stage Payloads: Some variants may embed configuration data or even encrypted second-stage payloads within their resources section. These are decrypted and loaded into memory at runtime.

Dynamic Analysis — Behavioral Profile

Dynamic analysis reveals the runtime activities of RedLine Stealer, providing crucial behavioral indicators.

File System Activity:
- Creates its executable in %AppData% or %ProgramData%.
- May create temporary files for staging data.
- Accesses browser profile directories (e.g., C:\Users\<User>\AppData\Local\Google\Chrome\User Data\Default\Login Data, C:\Users\<User>\AppData\Roaming\Mozilla\Firefox\Profiles\<ProfileName>\cookies.sqlite).
- Accesses cryptocurrency wallet directories.
Registry Activity:
- Writes entries to HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.
- Queries registry keys related to installed software and system configuration.
Network Activity:
- Initiates HTTP/HTTPS connections to C2 servers.
- Sends POST requests containing encoded data (system info, credentials).
- Receives commands or additional payloads via HTTP/HTTPS GET requests.
- Beaconing intervals can vary, often between 30 seconds to several minutes.
- Wireshark/tcpdump Capture Patterns: Look for outbound TCP connections on ports 80/443 to suspicious IPs/domains. Analyze the POST requests for unusual User-Agent strings and large, potentially encoded or compressed data payloads. Lack of SNI in HTTPS traffic might be a subtle indicator of non-browser traffic, though many RedLine variants use HTTPS.
Process Activity:
- May spawn cmd.exe or powershell.exe for specific tasks, though often it performs actions directly.
- If a loader is used, it might inject into legitimate processes (e.g., explorer.exe, svchost.exe).
Memory Artifacts:
- Decrypted strings related to targets and C2 infrastructure in memory.
- Injected code segments if process injection is used.
- Raw data buffers containing stolen credentials before encryption and exfiltration.

Real-World Attack Campaigns

RedLine Stealer has been a consistent player in the cybercrime landscape. Documented campaigns often highlight its role as a readily available tool for various threat actors.

Broad Phishing Campaigns (Ongoing): Numerous campaigns distribute RedLine Stealer via emails containing malicious attachments (e.g., fake invoices, shipping notifications) or links to download sites disguised as software repositories. Victimology is broad, encompassing individuals and small to medium-sized businesses across various sectors, primarily in North America and Europe. The impact is direct financial loss through credential theft and cryptocurrency theft.
Bundled with Pirated Software (Frequent): RedLine Stealer is frequently found bundled with cracked software, game cheats, and utility tools advertised on forums and websites. Users downloading such content unknowingly install the stealer. This campaign targets gamers, software developers, and general users seeking free software, primarily in regions with higher rates of software piracy.
Exploit Kit Payloads (Historical/Declining): In earlier stages, RedLine Stealer was observed as a secondary payload delivered by exploit kits targeting vulnerabilities in browsers and plugins. These campaigns were widespread, affecting users who visited compromised websites. While less prevalent now, this vector still poses a risk.
Targeted Data Theft Operations (Less Common but Possible): While RedLine is a commodity stealer, sophisticated actors might use it as a reconnaissance tool or initial access vector in more targeted attacks, leveraging its ability to quickly gather credentials that can be used for further lateral movement or privilege escalation.

Active Malware Landscape — Context

RedLine Stealer is a prominent example of the "Malware-as-a-Service" (MaaS) model in the information stealer domain.

Current Prevalence and Activity Level: RedLine Stealer remains highly active. Recent data from MalwareBazaar and VirusTotal consistently shows new samples being uploaded and detected daily. Its availability on underground forums as a cheap or even free (in some cases, for specific versions) tool ensures its widespread adoption by various cybercriminals.
Competing or Related Malware Families: RedLine competes with other popular information stealers such as Raccoon Stealer, Vidar Stealer, Agent Tesla, and HawkEye Keylogger. These families often share similar functionalities and distribution methods.
Relationship to Ransomware-as-a-Service (RaaS) or Malware-as-a-Service (MaaS): RedLine Stealer is a prime example of MaaS. Its developers likely sell access to the malware or its control panel, or provide it as a service to other cybercriminals. The stolen credentials are a valuable commodity that can be used to gain initial access for ransomware deployment, further phishing, or direct financial fraud.
Typical Target Industries and Geographic Distribution: RedLine Stealer is not typically nation-state targeted but rather aims for broad compromise for financial gain. Its targets are therefore diverse, including individuals, small businesses, and larger enterprises across all sectors. Geographically, it has a global reach, with significant activity observed in North America, Europe, Asia, and South America.

Detection & Hunting

Sigma Rules

title: RedLine Stealer - Suspicious Registry Run Key Persistence
id: 2345a1b2-c3d4-5e6f-7890-1234567890ab
status: experimental
description: Detects the creation of a new registry Run key entry for persistence, a common tactic used by RedLine Stealer.
author: Malware Analyst
date: 2026/04/26
logsource:
    product: windows
    service: sysmon
detection:
    selection_registry:
        EventID: 12 # RegistryEvent
        TargetObject|startswith: 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run\'
        TargetObject|contains: '\' # Ensure it's a key, not the root
    selection_process:
        EventID: 1 # ProcessCreate
        Image|endswith:
            - '.exe'
            - '.dll' # Though less common for direct execution, can be loaded
        # We are looking for processes that are NOT standard system processes,
        # creating persistence. This is a heuristic.
        Image|endswith:
            - 'cmd.exe'
            - 'powershell.exe'
            - '.exe'
    filter_legit_processes:
        Image|endswith:
            - 'svchost.exe'
            - 'explorer.exe'
            - 'regedit.exe'
            - 'msiexec.exe'
            - 'wermgr.exe'
            - 'smartscreen.exe'
            - 'backgroundtaskhost.exe'
            - 'ctfmon.exe'
            - 'spoolsv.exe'
            - 'fontdrvhost.exe'
            - 'taskeng.exe'
            - 'wuauclt.exe'
            - 'browserprocess.exe' # For Edge
            - 'chrome.exe' # Might be legitimate, but context is key
            - 'firefox.exe' # Might be legitimate, but context is key
    condition: selection_registry and selection_process and not filter_legit_processes
fields:
    - Computer
    - User
    - Image
    - CommandLine
    - TargetObject
    - Details
tags:
    - attack.persistence
    - attack.t1547.001
    - malware.redline

title: RedLine Stealer - Suspicious Network Beacon with Common User Agent
id: fedcba98-7654-3210-fedc-ba9876543210
status: experimental
description: Detects outbound HTTP POST requests with User-Agent strings commonly used by RedLine Stealer, targeting specific paths like '/gate.php'.
author: Malware Analyst
date: 2026/04/26
logsource:
    product: windows
    service: sysmon
detection:
    selection_network:
        EventID: 3 # NetworkConnection
        Protocol: 6 # TCP
        DestinationPort: 80 or 443
    selection_http_method:
        # This requires HTTP logging, usually from a proxy or advanced EDR.
        # If only Sysmon network logs are available, this part is indicative.
        # Assuming a proxy logs HTTP details or EDR can parse this.
        HttpRequest.HttpMethod: "POST"
    selection_path:
        HttpRequest.Url|contains: '/gate.php'
    selection_user_agent:
        HttpRequest.UserAgent:
            - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/*'
            - 'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/*'
            - 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/*'
            # Add other common browser UAs if observed
    condition: selection_network and selection_http_method and selection_path and selection_user_agent
fields:
    - Computer
    - User
    - Image
    - DestinationIp
    - DestinationPort
    - HttpRequest.Url
    - HttpRequest.UserAgent
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1071.001
    - malware.redline

EDR / SIEM Detection Logic

Process Tree Anomalies:
- Detect mshta.exe or wscript.exe/cscript.exe processes spawning cmd.exe or powershell.exe with obfuscated or encoded commands.
- Monitor for suspicious process creations where the executable path is unusual (e.g., AppData\Roaming, %TEMP%).
- Detect processes with unusual parent-child relationships, such as a Word document spawning cmd.exe.
Network Communication Patterns:
- Alert on HTTP/HTTPS POST requests to unusual or newly registered domains, especially those with /gate.php or similar patterns in the URL.
- Monitor for connections to known malicious C2 IPs or domains associated with RedLine Stealer.
- Track User-Agent strings that mimic browsers but originate from non-browser processes.
File System Telemetry Triggers:
- Alert on executables being dropped into AppData\Roaming, AppData\Local, or %TEMP% directories.
- Monitor for access to sensitive browser profile directories (e.g., Login Data, cookies.sqlite, logins.json) by non-browser processes.
- Detect creation of new entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\Software\Microsoft\Windows\CurrentVersion\Run by non-system processes.
Registry Activity Patterns:
- Alert on suspicious modifications to Run keys.
- Monitor for registry queries related to installed software that might indicate reconnaissance for credential harvesting.

Memory Forensics

# Volatility3 detection commands

# Dump process memory for analysis of strings and artifacts
# Replace <PID> with the process ID of the suspicious process
vol -f <memory_image_path> windows.memmap.Memmap --pid <PID> -o memory_dump.bin

# Extract strings from a process dump
strings memory_dump.bin | grep -iE "gate\.php|Login Data|Cookies|Wallet|Firefox|Chrome|OpenVPN|WinSCP|FileZilla"

# Identify .NET processes and extract their memory
# Useful if RedLine is a .NET binary
vol -f <memory_image_path> windows.dotnet.Dump -o /tmp/dotnet_dumps/

# Look for suspicious DLLs loaded into processes
vol -f <memory_image_path> windows.dlllist.DllList --pid <PID>

# Uncover hidden processes (if the malware attempts to hide itself)
vol -f <memory_image_path> windows.pslist.PsList --hidden

# Analyze network connections from processes
vol -f <memory_image_path> windows.netscan.NetScan

# Search for specific API calls or code patterns within process memory (requires more advanced analysis or plugins)
# Example: Searching for common encryption/decryption API calls if known
# vol -f <memory_image_path> windows.malfind.Malfind --pid <PID>

Malware Removal & Incident Response

Isolation Procedures: Immediately isolate the affected endpoint from the network to prevent lateral movement and further C2 communication. This can be achieved by disabling the network adapter or using host-based firewall rules.
Artifact Identification and Collection: Collect volatile data (running processes, network connections, loaded DLLs, command history) and non-volatile data (executables, configuration files, registry entries, logs). Use forensic tools to create a disk image for deeper analysis.
Registry and File System Cleanup:
- Remove persistence mechanisms: Delete entries from HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run.
- Delete scheduled tasks created by the malware.
- Remove dropped executables from common locations (%AppData%, %ProgramData%, %TEMP%).
- Clean up any created mutexes.
Network Block Recommendations: Block known RedLine Stealer C2 IPs and domains at the firewall and DNS level. Update intrusion detection/prevention systems (IDS/IPS) with relevant signatures.
Password Reset Scope: Advise users to reset passwords for all accounts whose credentials might have been stored on the compromised machine, especially web browsers, FTP clients, VPNs, and cryptocurrency wallets. Consider a broader password reset policy if domain credentials are suspected to be compromised.

Defensive Hardening

Specific Group Policy Settings:
- Disable mshta.exe execution: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> HTML Applications -> Disable HTML Applications (Set to Enabled). This mitigates a common initial execution vector.
- Enable PowerShell Script Block Logging: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Windows PowerShell -> Turn on PowerShell Script Block Logging (Set to Enabled).
- Restrict regedit.exe execution: Use AppLocker or Software Restriction Policies to limit regedit.exe execution to trusted administrators.
Firewall Rule Examples:
- Outbound Block: Block outbound TCP traffic on ports 80 and 443 to known RedLine C2 IPs or domains.
- Inbound Block: Ensure no unnecessary inbound ports are open, especially for RDP (3389) unless strictly required and secured.
Application Whitelist Approach: Implement application whitelisting (e.g., using AppLocker or Windows Defender Application Control) to only allow known, trusted applications to run. This significantly reduces the risk of executing unknown malware.
EDR Telemetry Tuning: Ensure your EDR solution is configured to collect detailed process creation, network connection, registry, and file system events. Tune detection rules to minimize false positives while maximizing coverage for RedLine's TTPs. Prioritize behavioral analytics over signature-based detection for evolving threats like RedLine.
Network Segmentation Recommendation: Implement network segmentation to limit the blast radius of a compromise. Critical servers and sensitive data stores should be isolated from user workstations and less trusted network segments.

References

MalwareBazaar: https://bazaar.abuse.ch/browse.php?search=RedLine%20Stealer
VirusTotal: https://www.virustotal.com/
OTX AlienVault: https://otx.alienvault.com/
MITRE ATT&CK: https://attack.mitre.org/