RedLine is a .NET information stealer spread through phishing mail, fake installers for popular apps and cracked software. One campaign abused YouTube: videos for a bot tool with a description linking to a download hosted on GitHub.
Capabilities
Browser logins and cookies, Telegram data, VPN and FTP credentials, device reconnaissance and some remote control. Stolen credentials often end up used for lateral movement by whoever buys the logs.
Unpacking
stage 0 C++ launcher ("LauncherPatcher.exe" in the sample)
XOR-decrypts the next stage with a short ASCII key
stage 1 decrypted payload is injected into RegSvcs.exe
stage 2 .NET stealer, loaded into dnSpy after dumping
Injection into the legitimate RegSvcs.exe (a .NET services tool) makes the malicious activity appear to come from a trusted Microsoft binary.
Self-checks
Early in the stealer a Check function compares the machine's region with a list of countries to avoid. When it returns true, the process exits.
Configuration
The settings, including the C2 address, are base64-encoded and then XOR-encrypted. A short alphabetic key unlocks them, and a few lines of Python are enough to recover the server address and port.
c2 server : 51.89.155.45 : 22595
Takeaways
- RegSvcs.exe with outbound connections is rarely legitimate on a workstation.
- GitHub-hosted payloads referenced from YouTube descriptions are an easy block-list target.