{"id":13524,"date":"2022-03-21T11:39:09","date_gmt":"2022-03-21T11:39:09","guid":{"rendered":"https:\/\/www.dfi.ch\/redline-malware\/"},"modified":"2022-09-01T12:49:18","modified_gmt":"2022-09-01T12:49:18","slug":"redline-malware","status":"publish","type":"post","link":"https:\/\/www.cheops-technology.ch\/en\/redline-malware\/","title":{"rendered":"REDLINE malware"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/h4>

REDLINE: The malware that hides in your downloads<\/span><\/h4>
Released in 2020, REDLINE is a malware that aims to steal your personal data.<\/span> <\/em><\/h5>

Mostly present in software cracks, the REDLINE malware can also be detected in PDF files, archives (ZIP and RAR), and any other documents. Mostly present in software cracks, the REDLINE malware can also be detected in PDF files, archives (ZIP and RAR), and any other documents.<\/p>

The main objective of this malware is to steal the personal data of infected users. Such as credentials stored in browsers or third-party applications, bank data, browser cookies, text files, screenshots or even cryptocurrency wallets. In some cases, the collected data may end up on the Internet.<\/p>

REDLINE is often accompanied by other malware. Either as a source or as part of a malware package in a malicious file. It can also serve as a gateway, giving attackers remote control and allowing them to deploy other malware such as ransomware, trojans or cryptocurrency miners.<\/p>

To give you an idea, here is an example of an attack:<\/span>
<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t
\n\t\t\t\t\n\t\t\t\t<\/i>\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t\t\t\t
\n\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\tDownloading the software\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t
\n\t\t\t\t\n\t\t\t\t<\/i>\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t\t\t\t
\n\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\tExecution of the downloaded software\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t
\n\t\t\t\t\n\t\t\t\t<\/i>\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t\t\t\t
\n\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\tRunning the malware in the background\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t
\n\t\t\t\t\n\t\t\t\t<\/i>\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t\t\t\t
\n\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\tCollection of data by the malware\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\t\t\t
\n\t\t\t\t\n\t\t\t\t<\/i>\t\t\t\t<\/span>\n\t\t\t<\/div>\n\t\t\t\n\t\t\t\t\t\t
\n\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\tSending the data to a remote server\t\t\t\t\t<\/p>\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>

A user downloads a video game in Peer-to-Peer, however, it contains a version of the REDLINE malware. When the game is installed, the malware runs in the background. The collection of system information begins. Once completed, the malware sends the information to a remote server and it will be retrieved by the attacker.<\/p>

To avoid this situation, we recommend that you take the following preventive actions into consideration :<\/em><\/p>