ThreatFox: RedLine Stealer IOCs

Hunt Hypothesis

This hunt targets the presence of RedLine Stealer indicators, a prevalent info-stealer that captures credentials, browser data, and cryptocurrency wallet contents from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify active infections and lateral movement attempts before the stolen data is exfiltrated, reducing the window of exposure for high-value assets.

IOC Summary

Malware Family: RedLine Stealer Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - RedLine Stealer
let malicious_hashes = dynamic(["8c82f607f14980a6962993f8800cdf35", "953b808caf22274577e975b21404fcd2b69fb3e8ad266f175b100612305d5575", "2217b5efd0ba9f67a74fe95ac7fff491816f0ddf"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — RedLine Stealer

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a microservice that includes a debug build of a third-party library containing a known RedLine Stealer hash (e.g., 4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d). The binary is temporarily copied to the build agent’s /tmp or C:\temp directory for compilation and testing before being packaged into a container image.

  • Filter/Exclusion: Exclude files located in standard build/temporary directories (e.g., C:\temp, /tmp, C:\Users\Public\BuildAgent) if the parent process is a known build tool (e.g., jenkins-agent.exe, dockerd.exe, msbuild.exe) and the file age is less than 1 hour.

• Scenario: An IT administrator performs a manual patching task using a vendor-provided installer for a legacy application (e.g., Adobe Flash Player or an older version of Java) that was downloaded directly from the vendor’s website. The installer’s SHA-256 hash matches one of the IOCs due to a known benign variant or a shared codebase with the malware family, and it is executed from the Downloads folder.

  • Filter/Exclusion: Exclude executions from the user’s Downloads or Desktop directories if the parent process is explorer.exe and the file has a valid digital signature from a trusted vendor (e.g., Adobe Inc., Oracle Corporation) and the file size is within the expected range for that specific installer.

• Scenario: A security team runs a YARA scan or a memory dump analysis tool (e.g., Volatility3 or YARA-Sigma) against