Family comparison

RedLine StealerMETA StealerVidar
Capability
RedLine StealerActive
META StealerActive
VidarActive
PlatformWindowsWindowsWindows
Dark Radar infection records10,592,8182,270,4265,662,081
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedVerified
Refreshing expired sessions———
AutofillVerifiedVerifiedVerified
macOS Keychain———
2FA and password managers——Verified
Financial
Saved cardsVerifiedVerifiedVerified
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerifiedVerifiedVerified
Clipboard address replacement———
Applications
Email clientsVersion-dependent——
FTP clientsVerifiedVerifiedVersion-dependent
VPN clientsVerifiedVersion-dependent—
Messaging applicationsVerifiedVerifiedVersion-dependent
Gaming platformsVerifiedVerifiedDark Radar observation
System
File collectionVerifiedVerifiedVerified
ScreenshotVerified—Verified
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload downloadVerifiedVerifiedVerified
Persistence———
Anti-analysis——Verified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed