YARA rules for RedLine
15 rules from 8 sources detect RedLine. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: Malware, Suspicious / hunting.
Family grouping is heuristic: check each rule's description.
Scan files with all RedLine rulesSearch rules
Matches rare strings found in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches prompt messages in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches error/success messages in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches view headers in Redline Panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Finds Redline samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-07Bytecodes found in late 2023 Redline malware
MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27Patterns observed in redline loader
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24Patterns observed in redline
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24Configuration related bytecodes in redline .net files
MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-11Detects typical stealer output files as created by RedLine or Racoon stealer
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17Rule to detect the RedLine payload
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-16Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc.
Suspicious / huntingCod3nym detection-rules· Jonathan Peters· 2024-01-05- ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1Metadata only
Detect Redline Stealer (August 2020)
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-24 - SECUINFRA_MAL_Redline_Certificate_BoschMetadata only
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02 - SECUINFRA_MAL_Redline_Certificate_GeforceMetadata only
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-13