Rewterz Threat Alert – RedLine Stealer – Active IOCs

Severity

High

Analysis Summary

RedLine Stealer is a type of malware that is used to steal sensitive information from infected computers. It is considered a relatively simple piece of malware and is often used as part of malicious campaigns to gather the information that can be used for further attacks. Redline can steal information from web browsers and has the ability to corrupt operating systems by installing harmful software. It steals user information from browsers, instant messaging applications, and file transfer protocol clients. According to the researchers, the malware first appeared in March 2020. Redline expanded throughout several nations during the COVID-19 epidemic and is still active today. Passwords, credit card information, cookies, usernames, locations, autofill data, and even hardware configurations such as keyboard layout, and UAC settings can be stolen by RedLine. RedLine is also capable of stealing cryptocurrency. This malware is a live campaign that is aimed at a variety of Asian organizations.

RedLine Stealer is considered a significant threat to individuals and organizations, as it can result in the theft of sensitive and valuable information. To protect against RedLine Stealer and other similar threats, it is recommended that individuals and organizations implement a robust cybersecurity program, including regular software updates, anti-malware protection, and employee training on the dangers of phishing and social engineering.

Impact

• Data Exfiltration
• Credential Theft
• Information Theft
• Financial Loss

Indicators of Compromise

MD5

• 69a222aa82b09d654679d5404351b351
• f378237ff6ab667bb77334641c70e8de
• c6d6879b53074e70c6a750d191a83e50
• c064ee3ebe18f36fdc96a451725e2d7b
• 137ff57edea11ba30b2f830b796f22dd

SHA-256

• 6acfb87b7bae0444e327aaaebda5273a6d094f217a6aa790deea6070e2e59938
• b8f34c3757c3bac6cd49cefa619b784134903a68f300e9bf83c316b217e45e4c
• 058b61ea015d828b37a09d3a2b49a2761984c9bc5152cd7ff2da0ad81387167f
• f6d4e46ec26427c852facdd4386ebb39a104e639702f8277783c9c69b7097f31
• be25926929b1aae0257d7f7614dd5ad637b8fd8e139c68f4d717e3dc9913e3cf

SHA-1

• f965746a5df85c533285ede19eeb5235ffa0e49d
• b60c0b776fcbbca30616f7972fe34a0add61267f
• 35f204b9df99eb1681b20d6031f8a96df1a5ff1e
• a402c7d27aefbb3856e023c95190478a61366333
• 0a79e13b2b2be9fc02dd9b6f2d978291f2f5b460

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets.