RedLine Stealer: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "Microsoft Visual C# Compiler (csc.exe)",
  "runtime": ".NET Common Language Runtime (CLR) 2.0.50727 or 4.0.30319",
  "binary_footprint": "PE32 .NET executable, typically 150 KB - 350 KB uncompressed",
  "stub_size": "262,144 bytes (vanilla stub), expanding up to 5 MB when wrapped in multi-stage packers or Lua loaders",
  "packer_obfuscation": "SmartAssembly, ConfuserEx, DotNetPusher, or packed within Lua bytecode interpreters executing native loaders",
  "subsystem": "Windows GUI (Subsystem 2)",
  "entry_point_flow": "Entry -> Decrypt Config (IP, ID, Key) -> Establish WCF Channel -> Call TryGetArgs() -> Parse ScanSettings -> Enumerate Browsers/Wallets/VPNs -> Construct User Data Contract -> Call SendHit() / SaveResult() -> Terminate",
  "technical_summary": "RedLine Stealer is a commercial information stealer coded in C#. It distinguishes itself by leveraging the Windows Communication Foundation (WCF) framework over raw TCP sockets (net.tcp protocol) or HTTP bindings to exchange structured DataContract objects with the C2 server. Its modular architecture dynamically retrieves scanning parameters from the C2 server before initiating harvesting routines."
}

{
  "interface_type": "Desktop Operator Client & Web Panel",
  "builder_tabs_options": [
    {
      "tab": "Builder Configuration",
      "options": [
        "IP / Port: Target C2 endpoint address and listener port (e.g., 194.26.29.112:4125)",
        "Build ID: Operator tracking tag (e.g., 'red_campaign_01')",
        "Encryption Key: String key used for XOR configuration obfuscation"
      ]
    },
    {
      "tab": "Scan Rules (Arguments)",
      "options": [
        "ScanBrowsers: Toggles extraction of Chrome, Edge, Brave, Opera, Firefox credentials",
        "ScanFiles: Enables desktop and documents file grabber with custom extension list",
        "ScanFTP: Toggles extraction of saved credentials from FileZilla and WinSCP",
        "ScanWallets: Activates scanning for Armory, Atomic, Electrum, Ethereum, Exodus, Coinomi",
        "ScanTelegram / ScanDiscord: Toggles session token extraction",
        "ScanVPN: Extracts configurations from NordVPN, OpenVPN, and ProtonVPN"
      ]
    }
  ],
  "config_struct_layout": [
    {
      "offset": "Arguments.IP",
      "field": "C2Address",
      "type": "String",
      "description": "XOR-encrypted C2 IP address or domain"
    },
    {
      "offset": "Arguments.ID",
      "field": "BuildId",
      "type": "String",
      "description": "Campaign identification identifier"
    },
    {
      "offset": "Arguments.Key",
      "field": "EncryptionKey",
      "type": "String",
      "description": "XOR passphrase string"
    },
    {
      "offset": "Arguments.Message",
      "field": "StatusMessage",
      "type": "String",
      "description": "Operational status tracking string"
    }
  ],
  "payload_generation_flags": [
    "Target CLR: AnyCPU",
    "String Encryption: Single-byte or multi-byte XOR with Base64",
    "WCF Binding: NetTcpBinding (SecurityMode.None)"
  ],
  "operator_commands": [
    "TryGetArgs: Invoked by client to obtain active scanning directives from C2",
    "SendHit: Invoked by client to transmit gathered credentials and hardware profile",
    "DownloadAndExecute: Instructs client to download external payload and execute via Process.Start"
  ],
  "interface_telemetry_analysis": "The RedLine management console provides operators with real-time log ingestion, filtering capabilities across harvested credentials, an integrated file viewer for grabber outputs, and detailed hardware telemetries including CPU architecture, installed anti-virus solutions, and UAC elevation states."
}

struct RedLine_Stealer_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Often delivered via multi-stage loaders utilizing Lua scripts or native shellcode stagers that inject the unpacked .NET assembly into target host processes (e.g., msbuild.exe, cvtres.exe, or AddInProcess.exe) via VirtualAllocEx and WriteProcessMemory.",
  "ntapi_functions": [
    "kernel32!VirtualAllocEx",
    "kernel32!WriteProcessMemory",
    "kernel32!SetThreadContext",
    "kernel32!ResumeThread",
    "crypt32!CryptUnprotectData"
  ],
  "process_hollowing_target": "msbuild.exe, cvtres.exe, or explorer.exe",
  "persistence_mechanics": [
    "Typically executed without persistence (single-run harvesting mission)",
    "When configured for persistence: Creates Run registry entry under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
  ],
  "evasion_hooks": [
    "Obfuscation of .NET metadata tokens and control-flow mangling via commercial protectors",
    "Dynamic runtime loading of assemblies via Assembly.Load(byte[])"
  ],
  "anti_analysis": [
    "WMI queries checking for virtual machine indicators: 'SELECT * FROM Win32_VideoController' evaluating Name for 'VirtualBox Graphics Adapter' or 'VMware SVGA'",
    "Evaluation of total physical memory (< 2GB) and CPU cores (< 2)",
    "Process enumeration checking for active monitoring tools (Wireshark, Fiddler, Process Hacker)"
  ]
}

Concrete technical breakdown of functional modules implemented in the RedLine Stealer binary:

{
  "framing": "WCF .NET binary framing or SOAP XML structure transmitted over raw TCP sockets",
  "serialization": ".NET DataContractSerializer encoding strongly-typed objects (ScanSettings, User, Result)",
  "handshake": "Client opens raw TCP connection to C2 port -> Transmits WCF framing preamble (0x00, 0x01, 0x00, 0x01, 0x02, 0x02) -> Initiates NetTcpBinding session -> Invokes TryGetArgs service method -> C2 returns XML/Binary serialized settings -> Client processes harvest and invokes SendHit",
  "cryptography": "Transport layer operates over plain TCP (SecurityMode.None) or TLS depending on builder selection. Payload data fields are obfuscated using multi-byte XOR combined with Base64 encoding.",
  "packet_types": [
    {
      "header": "WCF Action: TryGetArgs",
      "payload": "Client HWID, Campaign ID string",
      "direction": "Client -> C2"
    },
    {
      "header": "WCF Response: TryGetArgsResponse",
      "payload": "Serialized ScanSettings DataContract (boolean flags, file grabber rules)",
      "direction": "C2 -> Client"
    },
    {
      "header": "WCF Action: SendHit / SaveResult",
      "payload": "Serialized User DataContract (credentials, cookies, system info, wallet archives)",
      "direction": "Client -> C2"
    }
  ],
  "traffic_signature": "Outbound TCP connections to high-order ports (typ. 10000 - 50000) displaying WCF net.tcp stream preamble bytes (0x00, 0x01) followed by string references to 'http://tempuri.org/Entity/TryGetArgs'."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: