It also has remote functionality to drop and execute further malware onto the victim machine. The malware gathers information from web-browsers, file transfer protocol (FTP) clients, Instant Messengers (IM), cryptocurrency wallets, VPN services, and gaming clients. In all cases it attempts to perform illicit exfiltration of victims’ data. Once connection to its command and control (C2) panel is established, RedLine malware has a wide range of applications and services. Many samples of RedLine also appear with legit-looking digital certificates. RedLine is extremely versatile and has appeared variously as Trojanized services, games, cracks, and tools.

It has been active throughout 2020, and in 2021, it has additionally been delivered through malicious Google advertisements and spearphishing campaigns against 3D or digital artists using non-fungible tokens (NFTs), which are digital tokens tied to assets that can be bought, sold and traded. RedLine is a new infostealer malware family that is distributed via COVID-19 phishing email campaigns.

Filezilla malware 2020