Family comparison

CryptBotRedLine StealerVidar
Capability
CryptBotActive
RedLine StealerActive
VidarActive
PlatformWindowsWindowsWindows
Dark Radar infection records1,222,38310,592,8185,662,081
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedVerified
Refreshing expired sessions———
Autofill—VerifiedVerified
macOS Keychain———
2FA and password managers——Verified
Financial
Saved cardsVerifiedVerifiedVerified
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerifiedVerifiedVerified
Clipboard address replacement———
Applications
Email clients—Version-dependent—
FTP clients—VerifiedVersion-dependent
VPN clients—Verified—
Messaging applications—VerifiedVersion-dependent
Gaming platforms—VerifiedDark Radar observation
System
File collectionDark Radar observationVerifiedVerified
ScreenshotVerifiedVerifiedVerified
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload download—VerifiedVerified
Persistence———
Anti-analysisVersion-dependent—Verified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed