Active threat familyWindowsCredential theft
Malware Intelligence

RedLine Stealer

RedLine is a .NET-based infostealer that collects credentials, browser data, system information and various application data from victim systems. As soon as it runs it takes an inventory of the system, then collects browser, wallet, FTP, VPN and messaging data.

On 28 October 2024, Operation Magnus, led by the Dutch police, shut down its servers; investigators gained access to its source code and license servers. Leaked and cracked versions remain in circulation.

Activity map

Activity mapAttachmentDownloadsInjectionPackagingExfiltrationDownloadDownloadExtractionExecutionDownloadDownloadExecutionPhishing emailInvoice, orderONEOneNote attachmentHTAEmbedded HTABATEmbedded BATPowerShellDownloaderRedLine StealerInfostealerMSBuild.exeDark Radar 100%Data collection28 targetsLog archiveC2 serverUnlicensedsoftware siteCrack, game cheatVideo descriptionYouTubeRARPassword-protectedarchiveEXESetup.exeSponsoredsearch adFake download siteCopy of legitimate softwa…EXEInstallerLegitimate software + pay…
Executable payloadFileDark Radar evidence
Malicious payloadRedLine Stealer · Infostealer

RedLine is a .NET-based infostealer that collects credentials, browser data, system information and various application data from victim systems. As soon as it runs it takes an inventory of the system, then collects browser, wallet, FTP, VPN and messaging data.

Appears in flows

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software
  • Security software
  • Running processes
  • Screenshot
  • Desktop files

Credentials and application data

  • Saved passwords
  • Session cookies
  • Autofill
  • Saved cards
  • Discord
  • Steam
  • Exodus
  • Electrum
  • Atomic Wallet
  • Bitcoin Core
  • Ethereum keystore
  • Coinomi
  • MetaMask
  • Binance Wallet
Dark Radar infection records
10,592,818
Latest infection record
29 October 2026
Malware type
Infostealer
First seen
February 2020
01

Overview

For years it was the most widely distributed stealer family; its logs were the main source of credential marketplaces.

Ranks 1 of 52 families in Dark Radar data, with 10,592,818 infection records.

Other names: RECORDSTEALER

02

Origin and evolution

  1. February 2020Went on sale on Russian forums for a $100–150 lifetime license or a $100 monthly subscription.Malpedia (Fraunhofer FKIE)
  2. 2021Spread through fake installers and unlicensed software sites.Trend Micro
  3. 2023Distributed through OneNote attachments and fake updates.Zscaler
  4. 2024Named among the sources of credentials used to access Snowflake customer environments.Google Cloud (Mandiant)
  5. October 2024Disrupted together with META in Operation Magnus; charges were filed in the US against a developer.Malpedia (Fraunhofer FKIE)
03

Technical profile

Malware typeInfostealer
Target operating systemWindows
Primary purposeData theft
Threat categoryCredential theft
Programming language.NET (C#)
Distribution modelLifetime license or monthly subscription (MaaS)
First seenFebruary 2020
Public source confidenceHigh
04

Targeted applications

28 applications9 categories
05

Data collection

Credentials

  • Browser passwords98%Verified
  • Session cookies100%Verified
  • Refreshing expired sessions—
  • Autofill94.5%Verified
  • macOS Keychain—
  • 2FA and password managers—

Financial

  • Saved cards7%Verified
  • Desktop crypto walletsVerified
  • Wallet extensionsVerified
  • Clipboard address replacement—

Applications

  • Email clientsVersion-dependent
  • FTP clientsVerified
  • VPN clientsVerified
  • Messaging applications36%Verified
  • Gaming platforms3.5%Verified

System

  • File collectionVerified
  • ScreenshotVerified
  • System inventory98%Verified

Behavior

  • Additional payload downloadVerified
  • Persistence—
  • Anti-analysis—
06

File system

User profile (%USERPROFILE%)
File details are in Dark Radar IntelligenceOpen in Intelligence
07

System components

  • Username, computer name, location and time zone
  • Hardware (CPU, graphics card, memory) via WMI queries
  • Installed security software (SecurityCenter2)
  • Installed software and running processes
  • Screen resolution and language
08

How it works

  1. 1Infection

    • Phishing emails and malicious attachments.
    • Unlicensed software, game cheats and fake update pages.
    • Fake download sites promoted through sponsored ads.
    T1566.001Spearphishing Attachment

    Breaking point: Email attachments, sponsored ad links and unlicensed software downloads are blocked at the email and web gateway.

  2. 2Execution and evasion

    • The payload usually arrives inside a crypter and is unpacked in memory.
    • The C2 address and build ID in the configuration are decoded.
    Dark Radar observation

    Ran inside the legitimate MSBuild.exe process (latest 200 logs, 100%).

    T1204.002User Execution: Malicious FileT1027Obfuscated Files or InformationT1140Deobfuscate/Decode Files or Information

    Breaking point: Unsigned files running from user folders and injections into .NET tools are stopped by application control and EDR.

  3. 3Discovery

    • A system inventory is taken; security software and location information are collected.
    T1082System Information DiscoveryT1518.001Security Software DiscoveryT1518Software DiscoveryT1614System Location DiscoveryT1057Process Discovery

    Breaking point: Bulk system and security software queries from a short-lived process trigger an EDR alert.

  4. 4Data collection

    • Browser databases, wallets, FTP and VPN configurations are read.
    • Desktop files are collected according to settings from the panel.
    Dark Radar observation

    Data found in the latest 200 logs: password file 98%, cookies 100%, autofill 94.5%, cards 7%, wallets 0.5%.

    T1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1552.001Credentials In FilesT1113Screen CaptureT1005Data from Local System

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

  5. 5Exfiltration and C2

    • Collected data is sent to the C2 server; the server can return additional tasks from the panel.
    T1095Non-Application Layer ProtocolT1105Ingress Tool TransferT1041Exfiltration Over C2 Channel

    Breaking point: Traffic to newly registered domains, direct IP addresses and non-standard ports is blocked.

  6. 6Persistence and aftermath

    • Tasks to download and run files and execute commands.

    Breaking point: When an infection is confirmed, all sessions and access tokens on the device are revoked.

09

Network communication

This section is in Dark Radar IntelligenceOpen in Intelligence
10

MITRE ATT&CK

Initial Access
Execution
Defense Evasion
Credential Access
Discovery
Collection
Command and Control
Exfiltration
11

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
12

Risk and impact

  • VPN and FTP credentials provide direct access to the corporate network and web servers.
  • As in the Snowflake incident, unchanged passwords from years-old logs can still be used today.
  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
13

Defense

  • Tie VPN access to multi-factor authentication and device compliance checks.
  • Use key-based SFTP instead of FTP; turn off password saving in FileZilla.
  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
14

Learning center

How does this malware spread?
  • Phishing emails and malicious attachments.
  • Unlicensed software, game cheats and fake update pages.
  • Fake download sites promoted through sponsored ads.
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which Windows artifacts should be examined?
  • Prefetch (C:\Windows\Prefetch) — shows that a short-lived payload ran.
  • Amcache.hve and ShimCache — path and hash of the executed file.
  • Downloads folder and Zone.Identifier stream — the address the file was downloaded from.
  • Browser history — the fake download page or fake CAPTCHA address.
  • RunMRU registry key — commands pasted into the Run dialog.
  • Randomly named folders and DLLs under %TEMP% and %LOCALAPPDATA%.
Which log records matter?
  • Sysmon Event 1 / Security 4688Process creation: unsigned processes starting from Temp and Downloads folders, mshta, powershell -enc chains.
  • Sysmon Olay 11 / 23File creation and deletion: self-deleting payloads, DLLs dropped under Temp.
  • Sysmon Olay 3 / 22Network connection and DNS query: to newly registered domains, C2 resolution via Telegram, Steam or Pastebin.
  • Object access auditing (4663)A process other than the browser reading Login Data, Cookies and Local State files.
  • PowerShell 4104Script block logging: obfuscated downloader commands.
  • Identity provider sign-in logsSessions after the infection from a different country and device, without a multi-factor authentication prompt.
Which MITRE techniques is it associated with?
T1566.001Spearphishing AttachmentT1204.002User Execution: Malicious FileT1027Obfuscated Files or InformationT1140Deobfuscate/Decode Files or InformationT1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1552.001Credentials In FilesT1082System Information DiscoveryT1518.001Security Software DiscoveryT1518Software DiscoveryT1614System Location DiscoveryT1057Process DiscoveryT1113Screen CaptureT1005Data from Local SystemT1095Non-Application Layer ProtocolT1105Ingress Tool TransferT1041Exfiltration Over C2 Channel
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
15

Sources

Related families

META StealerVidarRaccoon StealerCompare

Related terms

Stealer logsCrypterJoinerCredential leakInfostealerDark web monitoring
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans