Contents

• Overview
• About Redline Stealer
• Sample Origin and Context
• Technical Analysis
  • Browsers and Cookies
  • Wallet
  • CreditCard Details
  • System Information
    • Drive Data
    • Installed programs
    • Current Process
  • VPN
  • FTP client
  • Games
  • Telegram and Discord
  • Miscellaneous Features
• Exfiltration
• IOCs
• YARA Rule
• MITRE ATT&CK

Overview

Some stealer families tend to stick around and evolve over time, and in this blog, we’re taking a closer look at one of them. We’ll be analyzing a redline stealer sample that spreads through a cracked version of Netflix, tricking users into running a malicious file. It’s a .NET-based payload designed to steal sensitive information such as browser data, cookies, cryptocurrency wallets, and Telegram data , etc. all of which we'll explore in detail throughout this blog.

About Redline Stealer

RedLine Stealer has been active in the wild since 2020 and continues to evolve with new features. The initial variant emerged during the COVID-19 pandemic, often distributed through fake awareness emails. Since then, its delivery methods have diversified, including fake application installers, malicious Google ads, spoofed Windows 11 upgrade tools, gaming cheat software, and photo editing programs. While RedLine Stealer is not typically shared via Telegram channels, it is actively distributed through underground forums on the dark web by various threat actors.

Sample Origin and Context

The sample is actually a fake cracked version of Netflix named "NetFlix Checker by xRisky v2.rar", which has been shared across the internet. What’s surprising is that it was being distributed through an active Telegram channel back in 2023 and even today, it’s still available online. This just shows how these kinds of files can stay around for a long time without getting removed.

The malicious cracked version is shared by an actor known as xRisky, who is known for distributing cracked versions of various internet tools and applications.

The .rar archive contains an executable file named "NetFlix Checker by xRisky v22.exe", which displays a fake Netflix logo to appear legitimate and trick users into thinking it's a real application.

After the file is executed, it drops three additional malicious files into the victim’s AppData folder. The main payload is stored in a file named winlogon.exe, as observed in analysis screenshots. This file is a **.**NET binary, which we will thoroughly analyze in the upcoming sections.

Technical Analysis

The script's functions are obfuscated using hexadecimal-encoded values, making it more difficult for malware analysts to understand and reverse-engineer its behavior.

Browsers and Cookies

The script scans for browsers such as Chrome, Opera GX, and Yandex. It also checks for Gecko, which is not a browser itself but a web rendering engine developed by Mozilla. Gecko is responsible for displaying web content in browsers like Firefox.

It steals data such as the browser name, profile paths, saved logins, cookies, autofill entries, and credit card details from the detected browsers. Additionally, it looks for the LocalPrefs.json file within the Local State directory.

Wallet

The script checks for cryptocurrency wallets by scanning the system’s ****directory located at:

C:\Users\Username\AppData\Roaming

It specifically searches for the presence of the following wallet folders:

Armory

Atomic

Coinomi

Electrum

Ethereum

Exodus

Guarda

Jaxx Liberty

Yoroi wallet

Tronlink

Nifty wallet

Metamask

Mathwallet

Coinbase

BinanceChain

BraveWallet

EqualWallet

BitAppWallet

iWallet

Wombat

MewCx

GuildWallet

SaturnWallet

RoninWallet

CreditCard Details

The script attempts to extract credit card details saved in browser cookies and browsing history. It collects data such as the cardholder name, card number, expiration month and year, and other related information.

System Information

The script attempts to retrieve the system’s username and password using the User Config module. It then proceeds to collect additional information about the victim, including city, country, geolocation, and machine name.

Drive Data

The stealer scans all available drives on the system and attempts to collect data by using the EnumerateDirectories method to list directories and the GetFiles method to scan files within them. It specifically targets folders such as \Windows , \Program Files, \Program Files (x86), and \ProgramData to steal sensitive information.

Installed programs

The script also queries the following registry path:

HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

This path contains information about software installed on the system, particularly applications installed for all users. The script iterates through each subkey within this path to gather details about the installed programs.

From the registry path, the script collects information such as the DisplayName and DisplayVersion of each installed program.

Current Process

The script also retrieves the current process session ID, which can be used to identify or track the active user session on the system.

VPN

The script uses the ScanDetails method to search for VPN-related data stored on the user’s PC. It specifically looks for accounts associated with the following VPN services:

• NORDVPN
• ProtonVPN
• OpenVPN

FTP client

The script searches the following path in the user’s registry folder:

C:\Users\\AppData\Roaming\FileZilla\

to locate two important files:

• recentservers.xml, which contains details of the most recently connected FTP/SFTP servers, including Host, Port, Protocol, Username, and Password
• sitemanager.xml, which stores manually saved sites in FileZilla’s Site Manager.

Games

The script searches the Windows registry under the following path:

Software\Valve\Steam

It uses the user config module to steal all files with the .vdf extension found within this directory.

Valve, the company behind popular games and technologies, operates Steam, a digital distribution platform for downloading and managing PC games and software. These .vdf files contain important information such as the Steam installation path, last logged-in username, language preferences, and a list of installed or recently used games.

The script also searches for other gaming platforms by using the GameLauncherFiles method.

Telegram and Discord

The malicious script searches for Telegram session data in the following path:

C:\Users\Username\AppData\Roaming\Telegram Desktop\tdata

The script also looks for Discord data in the following directory:

%appdata%\discord\Local Storage\leveldb

It specifically searches for files with the .log and .db extensions to steal credentials and other sensitive information stored within them.

Miscellaneous Features

Screenshot of a screen

The stealer sets the screenshot’s height and width, captures an image of the display screen, and saves it as a bitmap file.

GeoPlugin

The malware uses GeoPlugin, an IP geolocation API service that enables websites and applications to determine a user’s geographic location based on their IP address. Using GeoPlugin, the stealer collects data such as the user’s city, region, country code, latitude, and longitude.

Exfiltration

After collecting all the data, the stealer attempts to send it in chunks using the POST method to the C2 server at siyatermi[.]duckdns[.]org:17044.

IOCs

File / Server	Hash / Address
NetFlix Checker by xRisky v2.rar	8b11d84d23da2e54a3d4f5a5e9fdf56fcb44b3e84369facbbea1e473c9956f69
NetFlix Checker by xRisky v22.exe	e3544f1a9707ec1ce083afe0ae64f2ede38a7d53fc6f98aab917ca049bc63e69
chrome.exe	8d3be8f563da5c4475787349bc24d3d0020e0a29c19f62f96dd605cd4e10b974
winlogon.exe	f7ab09dc45caeaccd9f2020c501827d41ed5efb7f60cc216bf6404d6fc94741d
c2 server	siyatermi[.]duckdns[.]org:17044

YARA Rule

MITRE ATT&CK

Tactic	Technique	Description
Initial Access	Phishing (T1566)	Delivered via malicious cracked software distributed through Telegram and other channels.
Execution	User Execution (T1204)	Execution of the .exe payload disguised as a legitimate Netflix checker.
Defense Evasion	Obfuscated Files or Information (T1027)	Functions encrypted using hex encoding to complicate analysis.
Credential Access	Credentials from Web Browsers and Applications (T1555.003)	Steals credentials and sensitive data from browsers, VPN clients, FTP clients, gaming platforms (Steam), and Discord.
Discovery	System Information Discovery (T1082)	Gathers system details such as username, machine name, geolocation (via GeoPlugin), and installed software (registry queries).
	File and Directory Discovery (T1083)	Enumerates drives and specific directories like Windows, Program Files, and ProgramData folders.
	Process Discovery (T1057)	Retrieves current process session ID.
Collection	Input Capture (T1056)	Takes screenshots of the display and saves bitmap images.
	Data from Local System (T1005)	Collects various sensitive files and configuration data from the local system.
Command and Control	Exfiltration Over Command and Control Channel (T1041)	Sends collected data in chunks via HTTP POST requests to C2 server siyatermi[.]duckdns[.]org:17044.