Family comparison

PureLogsRedLine Stealer
Capability
PureLogsActive
PlatformWindowsWindows
Dark Radar infection records831,64010,592,818
Credentials
Browser passwordsVerifiedVerified
Session cookiesVerifiedVerified
Refreshing expired sessionsDark Radar observation—
AutofillDark Radar observationVerified
macOS Keychain——
2FA and password managers——
Financial
Saved cardsVerifiedVerified
Desktop crypto walletsVerifiedVerified
Wallet extensionsVerifiedVerified
Clipboard address replacement——
Applications
Email clientsDark Radar observationVersion-dependent
FTP clients—Verified
VPN clientsVerifiedVerified
Messaging applicationsVerifiedVerified
Gaming platformsDark Radar observationVerified
System
File collection—Verified
ScreenshotDark Radar observationVerified
System inventoryVerifiedVerified
Behavior
Additional payload download—Verified
Persistence——
Anti-analysis——
Verified
Version-dependent
Reported
Dark Radar observation
Not observed