Summary: 2025/04/28 23:58
First reported date: 2016/10/04
Inquiry period : 2025/03/29 23:58 ~ 2025/04/28 23:58 (1 months), 7 search results
전 기간대비 동일한 트렌드를 보이고 있습니다.
전 기간대비 상승한 Top5 연관 키워드는 c&c Phishing live Raccoon IoC 입니다.
악성코드 유형 GameoverP2P DYEPACK Stealc Xloader FormBook Emotet Remcos Nanocore RecordBreaker 도 새롭게 확인됩니다.
공격기술 Campaign RCE Remote Code Execution 도 새롭게 확인됩니다.
기관 및 기업 Kaspersky Russia Google ESET 도 새롭게 확인됩니다.
기타 Advertising Cryptocurrency Windows id66nn idcheat 등 신규 키워드도 확인됩니다.
RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. Ref.
* 최근 뉴스기사 Top3:
ㆍ 2025/04/18 Dark Web Market: STYX Market
ㆍ 2025/04/08 How MSSP Expertware Uses ANY.RUN’s Interactive Sandbox for Faster Threat Analysis
ㆍ 2025/04/06 HELLCAT Ransomware Group Strikes Again: Four New Victims Breached via Jira Credentials from Infostealer Logs
참고로 동일한 그룹의 악성코드 타입은 FormBook QakBot RedLine 등 101개 종이 확인됩니다.
Trend graph by period
Related keyword cloud
Top 100# | Trend | Count | Comparison |
---|---|---|---|
1 | RedLine | 7 | - 0 (0%) |
2 | c&c | 5 | ▲ 1 (20%) |
3 | Stealer | 4 | ▼ -1 (-25%) |
4 | C2 | 3 | - 0 (0%) |
5 | Malware | 3 | ▼ -1 (-33%) |
6 | Phishing | 3 | ▲ 2 (67%) |
7 | live | 3 | ▲ 1 (33%) |
8 | Campaign | 3 | ▲ new |
9 | Raccoon | 3 | ▲ 2 (67%) |
10 | IoC | 2 | ▲ 1 (50%) |
11 | intelligence | 2 | ▲ 1 (50%) |
12 | 2 | ▲ 1 (50%) | |
13 | Advertising | 2 | ▲ new |
14 | Exploit | 2 | ▲ 1 (50%) |
15 | Education | 2 | - 0 (0%) |
16 | GameoverP2P | 2 | ▲ new |
17 | Report | 2 | - 0 (0%) |
18 | United States | 2 | - 0 (0%) |
19 | DarkWeb | 2 | ▲ 1 (50%) |
20 | Lumma | 2 | ▲ 1 (50%) |
21 | Ransomware | 2 | ▲ 1 (50%) |
22 | Cryptocurrency | 1 | ▲ new |
23 | Windows | 1 | ▲ new |
24 | id66nn | 1 | ▲ new |
25 | idcheat | 1 | ▲ new |
26 | Vidar | 1 | - 0 (0%) |
27 | Operation | 1 | - 0 (0%) |
28 | Kaspersky | 1 | ▲ new |
29 | Russia | 1 | ▲ new |
30 | Software | 1 | ▲ new |
31 | Telegram | 1 | ▲ new |
32 | Criminal | 1 | ▲ new |
33 | RCE | 1 | ▲ new |
34 | Update | 1 | - 0 (0%) |
35 | Browser | 1 | ▲ new |
36 | VPN | 1 | ▲ new |
37 | Linux | 1 | ▲ new |
38 | attack | 1 | - 0 (0%) |
39 | 1 | ▲ new | |
40 | Takedown | 1 | ▲ new |
41 | target | 1 | - 0 (0%) |
42 | Kali | 1 | ▲ new |
43 | Cobalt Strike | 1 | ▲ new |
44 | DYEPACK | 1 | ▲ new |
45 | Government | 1 | - 0 (0%) |
46 | Vulnerability | 1 | ▲ new |
47 | Victim | 1 | - 0 (0%) |
48 | MFA | 1 | - 0 (0%) |
49 | Stealc | 1 | ▲ new |
50 | EDR | 1 | ▲ new |
51 | hacking | 1 | - 0 (0%) |
52 | 1 | ▼ -1 (-100%) | |
53 | 1 | ▼ -1 (-100%) | |
54 | ESET | 1 | ▲ new |
55 | Remote Code Execution | 1 | ▲ new |
56 | Xloader | 1 | ▲ new |
57 | Ba | 1 | ▲ new |
58 | FormBook | 1 | ▲ new |
59 | Emotet | 1 | ▲ new |
60 | Malware download | 1 | ▲ new |
61 | Remcos | 1 | ▲ new |
62 | Nanocore | 1 | ▲ new |
63 | Android | 1 | ▲ new |
64 | powershell | 1 | - 0 (0%) |
65 | RecordBreaker | 1 | ▲ new |
66 | Microsoft | 1 | - 0 (0%) |
67 | id | 1 | ▲ new |
Special keyword group
Top 5
Malware Type
This is the type of malware that is becoming an issue.
Keyword | Average | Label |
---|---|---|
RedLine |
|
7 (28%) |
Raccoon |
|
3 (12%) |
GameoverP2P |
|
2 (8%) |
Lumma |
|
2 (8%) |
Ransomware |
|
2 (8%) |

Attacker & Actors
The status of the attacker or attack group being issued.
Keyword | Average | Label |
---|

Country & Company
This is a country or company that is an issue.
Keyword | Average | Label |
---|---|---|
United States |
|
2 (25%) |
Kaspersky |
|
1 (12.5%) |
Russia |
|
1 (12.5%) |
|
1 (12.5%) | |
Government |
|
1 (12.5%) |
Malware Family
Top 5
A malware family is a group of applications with similar attack techniques.
In this trend, it is classified into Ransomware, Stealer, RAT or Backdoor, Loader, Botnet, Cryptocurrency Miner.
Threat info
Last 5SNS
(Total : 4)News
(Total : 3)RedLine Stealer Malware Phishing Raccoon Campaign c&c intelligence Email Advertising Education Exploit GameoverP2P United States DarkWeb Lumma Ransomware Report Cryptocurrency attack Xloader DYEPACK Linux Windows Vidar Kaspersky Russia RCE Telegram Takedown Criminal target Software Kali Microsoft Browser VPN Google Update RecordBreaker ESET Vulnerability Victim Attacker MFA Stealc EDR hacking Twitter LinkedIn Government powershell Remote Code Execution FormBook Emotet Remcos Nanocore Cobalt Strike Android IoC Operation
No | Title | Date |
---|---|---|
1 | Dark Web Market: STYX Market - Malware.News | 2025.04.18 |
2 | How MSSP Expertware Uses ANY.RUN’s Interactive Sandbox for Faster Threat Analysis - Malware.News | 2025.04.08 |
3 | HELLCAT Ransomware Group Strikes Again: Four New Victims Breached via Jira Credentials from Infostealer Logs - Malware.News | 2025.04.06 |
Additional information
No | Title | Date |
---|---|---|
1 | Employee monitoring app exposes users, leaks 21+ million screenshots - Malware.News | 2025.04.28 |
2 | Introducing XSIAM 3.0 - Malware.News | 2025.04.28 |
3 | Deploy Bravely with Prisma AIRS - Malware.News | 2025.04.28 |
4 | 2025 Cyber Resilience Research Discovers Speed of AI Advancing Emerging Attack Types - Malware.News | 2025.04.28 |
5 | Intel CEO Targets Change in Corporate Culture to Shape Up - Bloomberg Technology | 2025.04.28 |
View only the last 5 |
No | Title | Date |
---|---|---|
1 | Dark Web Market: STYX Market - Malware.News | 2025.04.18 |
2 | Dark Web Market: STYX Market - Malware.News | 2025.04.18 |
3 | How MSSP Expertware Uses ANY.RUN’s Interactive Sandbox for Faster Threat Analysis - Malware.News | 2025.04.08 |
4 | HELLCAT Ransomware Group Strikes Again: Four New Victims Breached via Jira Credentials from Infostealer Logs - Malware.News | 2025.04.06 |
5 | One in Four Cyberattacks in 2024 Traced to Infostealers, Huntress Reports - Malware.News | 2025.03.03 |
View only the last 5 |
Level | Description |
---|---|
danger | File has been identified by 69 AntiVirus engines on VirusTotal as malicious |
watch | Collects information about installed applications |
watch | Communicates with host for which no DNS query was performed |
watch | Harvests credentials from local FTP client softwares |
notice | Allocates read-write-execute memory (usually to unpack itself) |
notice | Checks adapter addresses which can be used to detect virtual network interfaces |
notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
notice | One or more potentially interesting buffers were extracted |
notice | Performs some HTTP requests |
notice | Queries for potentially installed applications |
notice | Steals private information from local Internet browsers |
info | Checks amount of memory in system |
info | Checks if process is being debugged by a debugger |
info | One or more processes crashed |
info | Queries for the computername |
info | Tries to locate where the browsers are installed |
info | Uses Windows APIs to generate a cryptographic key |
Network | ET MALWARE RedLine Stealer - CheckConnect Response |
Network | ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) |
Network | ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound |
Network | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) |
Network | SURICATA HTTP unable to match response to request |
No | Category | URL | CC | ASN Co | Date |
---|---|---|---|---|---|
1 | c2 | http://193.233.237.109:1912/ | RU ![]() | OOO FREEnet Group | 2025.04.22 |
2 | c2 | http://195.3.223.35:38397/ | PL ![]() | Meverywhere sp. z o.o. | 2025.03.10 |
3 | c2 | http://91.92.136.87:26264/ | BG ![]() | Belcloud LTD | 2025.02.19 |
4 | c2 | http://103.214.142.152:26264/ | HK ![]() | ... | 2025.02.12 |
5 | c2 | http://45.144.28.250:26912/ | GB ![]() | Digital LLC | 2025.02.12 |
View only the last 5 |
No | URL | CC | ASN Co | Reporter | Date |
---|---|---|---|---|---|
1 | https://bitbucket.org/x98989/8678678ff/downloads/fasdqweqw.dotm bitbucket doc docx maldoc RedLine | US ![]() | ATLASSIAN PTY LTD | DaveLikesMalwre | 2025.02.26 |
2 | https://bitbucket.org/x98989/8678678ff/downloads/word.zip bitbucket maldoc RedLine RedLineStealer zip | US ![]() | ATLASSIAN PTY LTD | DaveLikesMalwre | 2025.02.26 |
3 | https://raw.githubusercontent.com/lakrica0/asdfqw/main/wind.exe exe RedLine RedLineStealer | US ![]() | FASTLY | Riordz | 2025.02.11 |
4 | https://upload.venomtools.in/build.exe exe RedLine | US ![]() | CLOUDFLARENET | Riordz | 2025.02.11 |
5 | http://185.215.113.16/inc/Lead_dumper.exe RedLine | Riordz | 2025.02.01 | ||
View only the last 5 |