Redline Stealer

Hunt queries (Shodan, Censys, Fofa, URLScan)

Hunt query sharings are temporarily disabled.

Summary

TL; DR: A popular Windows infostealer

Type: Information stealer

Targeted Operating Systems: Windows

Interesting characteristics: N/A

Threat tag: win.redline_stealer

Reporting: https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

IOCs

• 5.189.138.247:7766
• 45.76.46.64:7766
• 147.45.45.81:7766
• 195.201.121.240:7766
• 45.15.156.142:7766
• 172.252.59.251:7766
• 5.75.163.194:7766
• 45.15.156.209:7766
• 182.237.220.248:8720
• 182.237.220.248:7766
• 103.74.106.117:7766
• 185.65.105.50:7766
• 8.142.22.26:10038
• 8.142.22.26:7766
• 45.15.156.127:7766
• 45.15.156.240:7766
• 45.15.156.15:7766
• 65.109.17.46:7766
• 138.201.195.156:7766
• 167.88.62.53:7766
• 5.42.65.36:7766
• 5.161.190.139:7766
• 185.215.151.236:7766
• 136.244.80.147:7766
• 209.126.11.251:7766
• 4.185.139.232:7766
• 185.78.76.2:7766
• 45.15.156.2:7766
• 185.133.40.202:7766
• 45.15.156.216:7766
• 5.42.81.51:7766
• 176.31.225.39:7766
• 176.31.225.39:4239
• 47.104.172.62:7369
• 47.104.172.62:8807
• 47.104.172.62:9911
• 47.104.172.62:7766
• 47.104.172.62:3001
• 47.104.172.62:7367
• 5.42.65.0:7766
• 5.42.65.50:7766
• 194.169.175.184:7766
• 195.2.78.228:7766
• 88.151.192.67:7766
• 94.156.67.67:7766
• 51.195.206.227:7766
• 45.140.147.183:7766
• 94.156.67.46:7766
• 95.164.89.184:7766
• 152.89.198.155:7766
• 94.156.67.140:7766
• 185.215.113.26:7766
• 147.45.44.16:7766
• 147.45.44.97:7766
• 185.215.113.67:7766
• 194.28.226.213:7766
• 185.172.128.33:7766
• 147.45.44.77:7766
• 47.104.172.62:7080
• 185.215.113.101:7766
• 45.77.166.78:7766
• 185.215.113.25:7766
• 218.3.69.61:7766
• 218.3.69.61:4556
• 147.45.44.56:7766
• 178.254.39.146:7766
• 193.3.19.146:7766
• 173.211.106.14:7766
• 120.46.173.94:8585
• 120.46.173.94:8686
• 120.46.173.94:7766