RedLine Malware (virus) - Free Instructions

What is RedLine Malware?

RedLine malware can steal your passwords, banking information, and cryptocurrency wallets

RedLine Malware steals users' passwords and other personal data

RedLine malware was first observed in 2020. It is an information stealer mainly targeting Windows users. It steals victims' passwords, autofill data, cryptocurrency wallets, browser information, FTP connections,^[1] and OS information such as system hardware, time zone, IP address, geolocation, OS version, and default language.

Cybercriminals can use this information to access various accounts, like social media, email, and banking. They can deceive people into transferring money and making fraudulent purchases. The malicious program can also infect victims' machines with other malware like ransomware, cryptocurrency miners, trojans, etc.

It shows up in users' systems as AddInProcess.exe which was flagged by 50 security vendors and 3 sandboxes as malicious. It also acts as a Trojan because it does not show any particular symptoms and performs tasks in the background. Most people may not even know that they have been infected by this malware.

Usually, people will notice that something is wrong if they suffer from financial losses or identity theft. If malware causes the installations of other malicious programs that can also be the point where users notice the infection. Otherwise, a lot of time can pass before users find out about the threat.

Distribution techniques

Currently, the RedLine malware is advertised on various cybercriminal forums as a MaaS (Malware-as-a-Service)^[2] model. The malicious program can be purchased through the Redline telegram official channel. The threat actors offer a monthly, weekly, and lifetime subscription for the prices of 100$, 150$, and 800$ respectively. They accept payment in Bitcoin, Ethereum, XMR, LTC, and USDT.

Those who buy the subscription use various methods to spread RedLine malware. Healthcare was one of several industry sectors affected by this threat in the last few months. Crooks take advantage of the global pandemic by using it in their social engineering scams. A spam email was found to distribute RedLine Stealer by disguising it as the Folding@home application:

RedLine Malware is distributed via email attachments and malicious links

The email comes from Shannon Wilson who claims to be working for Mobility Research Inc. It is a company providing rehabilitation solutions for physically disabled patients. The email urges recipients to help the company find a cure for the coronavirus by enrolling in the Folding.@Thome program.

Mobility Research does in fact have a project known as Folding@home, which lets participants donate computing power for disease research and computational drug design by downloading a particular app. As you can see the social engineering tactics the cybercriminals use are very clever. Even if victims did go online and tried to confirm the information in the email, they would not suspect a thing.

Researchers also found a scam website mydigitalcoin.info that was used to promote the malicious program:

RedLine Malware developers use social engineering to trick people into installing it

Here users are tempted with an attractive offer:

Get your free Bitcoin!
This page is not available for collecting satoshi because you do not have our advertising extension installed

You will get:
200000 satoshi

Install Chrome Extension
Our plugin is completely safe and installs in your browser, thanks to which you can collect satoshi every 5 minutes.

Supposedly, all that users have to do is just install a simple Chrome extension and they will receive free Bitcoin for doing nothing. With the craze of cryptocurrencies rising, threat actors use it to their advantage. There is no doubt that if you would click the Install button on this website you would open the doors for the virus to enter your system.

That is why you should be very careful while surfing the web, especially with email. If you do not know the person who sent the email, do not open any attachments or click on any links. Sometimes crooks do very good research and disguise the email as it was sent from one of your contacts. So if the email came from someone on your friend list but you were not expecting it, it would be beneficial to double-check with them through a different platform.

The removal process

It can be very difficult to detect and remove RedLine on time because it usually operates without showing any visible indications of its presence. It may take weeks, or even months for the victim to notice the effects of the virus activity. If you want to prevent such threats from entering your machine in the future, you should use professional security tools.

A PC without an antivirus is like a house without a door. Anti-malware tools can remove the intruders before they can do any changes to your system. SpyHunter 5Combo Cleaner and Malwarebytes are great tools that you can use for the full elimination of RedLine. We do not recommend performing the removal manually as you can leave some traces behind which could result in the renewal of the infection.

Some Trojan-based programs can block your security software and prevent you from accessing the settings for malware removal. If malware is not letting you use antivirus in normal mode, access Safe Mode and perform a full system scan from there:

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

Once you reach Safe Mode, launch SpyHunter 5Combo Cleaner, Malwarebytes, or another reputable antivirus, update it with the latest definitions and perform a full system scan to eradicate malware and all its malicious components.

Repair the damaged operating system

Performance, stability, and usability issues, to the point where a full Windows reinstall is required, are nothing unusual after a malware infection. These types of intruders can alter the Windows registry database, damage vital bootup, and other sections, delete or corrupt DLL files,^[4] etc. Once a system file is damaged, antivirus software cannot fix it.

Manual troubleshooting of such damage is also very complicated and can take a long time. This is why FortectIntego was developed. It can fix a lot of the damage caused by an infection like this. Blue Screen errors,^[5] freezes, registry errors, damaged DLLs, etc., can make your computer completely unusable. By using this useful maintenance tool, you could prevent yourself from having to reinstall Windows completely.

• Download the application by clicking on the link above
• Click on the ReimageRepair.exe
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.

If you experience setting changes in your browsers, like the homepage, new tab address, redirects, or push notifications, you can look for instructions on how to deal with those issues below this article. There is a big chance that the malware automatically installed other threats that could cause unwanted symptoms in your browsers. Guides are available for Google Chrome, Mozilla Firefox, MS Edge, and Internet Explorer.