RedLine Stealer

Description

RedLine Stealer is an information stealer first identified in 2020 and sold on underground forums as malware as a service, either as a standalone purchase or a subscription. It harvests saved browser credentials, autocomplete data, and credit card information, it takes a system inventory that includes installed security software, and it can upload and download files and execute commands on infected machines. Stolen data from the family has been resold on the deep and dark web to initial access brokers for further intrusions.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

RedLineRedLineStealerRedlineRedlineStealerRedlinestealer

MITRE ATT&CK techniques

35 techniques across 9 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.011Lua
- T1059.003Windows Command Shell
T1204User Execution
- T1204.002Malicious File

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.013Encrypted/Encoded File
- T1027.010Command Obfuscation
T1036Masquerading
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.007Msiexec
T1480Execution Guardrails
T1497Virtualization/Sandbox Evasion

TA0006 Credential Access

T1539Steal Web Session Cookie
T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1012Query Registry
T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1082System Information Discovery
T1087Account Discovery
- T1087.001Local Account
T1217Browser Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery
T1518Software Discovery
- T1518.001Security Software Discovery
T1614System Location Discovery
- T1614.001System Language Discovery

TA0009 Collection

T1005Data from Local System
T1113Screen Capture

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0040 Impact

T1657Financial Theft

TA0112 Defense Impairment

T1553Subvert Trust Controls
- T1553.002Code Signing
T1685Disable or Modify Tools

Alert name variants

Alert Name	Engine
Binary.Trojan.RedLine	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Infostealer.RedLine	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Ransomware.RedLine	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Spyware.Redline	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Spyware.RedLine	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Spyware.Redlinestealer	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Redline	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.RedLine	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Redlinestealer	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.RedlineStealer	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.RedLineStealer	ATP Sandbox Adv. Heuristics
Document-Excel.Ransomware.RedLine	ATP Sandbox Adv. Heuristics
Document-Office.Trojan.RedLine	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.RedLine	ATP Sandbox Adv. Heuristics
Email-MIME.Ransomware.RedLine	ATP Sandbox Adv. Heuristics
Email-MIME.Spyware.Redline	ATP Sandbox Adv. Heuristics
Gen:Variant.Spider.RedLine.1	AV
IL:Trojan.MSILZilla.RedLine.22424	AV
IL:Trojan.RedLine.1	AV
IL:Trojan.RedLine.2	AV
Script-JS.Downloader.RedLineStealer	ATP Sandbox Adv. Heuristics
Script-JS.Ransomware.RedLine	ATP Sandbox Adv. Heuristics
Script-PowerShell.Spyware.Redline	ATP Sandbox Adv. Heuristics
Script-PowerShell.Spyware.RedLine	ATP Sandbox Adv. Heuristics
Script-WScript.Ransomware.RedLine	ATP Sandbox Adv. Heuristics
Trojan.RedLine.3	AV
Win32.Infostealer.RedLine	ATP Sandbox Adv. Heuristics
Win32.Ransomware.RedLine	ATP Sandbox Adv. Heuristics
Win32.Spyware.Redline	ATP Sandbox Adv. Heuristics
Win32.Spyware.RedLine	ATP Sandbox Adv. Heuristics
Win32.Trojan.RedLine	ATP Sandbox Adv. Heuristics
Win32.Trojan.Redlinestealer	ATP Sandbox Adv. Heuristics
Win32.Trojan.RedlineStealer	ATP Sandbox Adv. Heuristics
Win32.Trojan.RedLineStealer	ATP Sandbox Adv. Heuristics
Win64.Ransomware.RedLine	ATP Sandbox Adv. Heuristics
Win64.Spyware.Redline	ATP Sandbox Adv. Heuristics
Win64.Spyware.RedLine	ATP Sandbox Adv. Heuristics
Win64.Trojan.RedLine	ATP Sandbox Adv. Heuristics
Win64.Trojan.RedlineStealer	ATP Sandbox Adv. Heuristics
Win64.Trojan.RedLineStealer	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Generic.Redlinestealer.Beacon traffic detected	IPS-SWG
MALWARE-CNC Win.Trojan.RedLine inbound command and control attempt	IPS-SWG
MALWARE-CNC Win.Trojan.Redline malicious file download	IPS-SWG
MALWARE-CNC Win.Trojan.Redline variant inbound response detected	IPS-SWG
MALWARE-CNC Win.Trojan.Redline variant outbound request detected	IPS-SWG
MALWARE-OTHER Win.Trojan.Redline variant download attempt	IPS-SWG