en
redlineredline-extendedRedlineLike Stealer (also known as redline and redline-extended) is a CyStack research label for information-stealer traces. RedlineLike Stealer targets browser credentials, cryptocurrency wallets, Telegram/Discord session tokens and FTP and SSH client configs. As of 23/10/2026, CyStack's research records 8 variants, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
RedLine extended-block log variants. UserInformation.txt files
emitting the canonical Redline Operation System: typo together
with the panel's identity, locale, and hardware fields. Several
Telegram-based affiliate channels rebrand the same RedLine builder
with custom banners (DARKSIDE, ZAPLINE, and similar) while keeping
the underlying field layout intact.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
8 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
125ec60... | 1,051,645 | Unknown |
5075536... | 10,983 | Unknown |
7402f6d... | 60 | Unknown |
81abf48... | 1 | Unknown |
8f791a8... | 1 | Unknown |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
* Telegram : <value> Country: <value>IP: <value>System Language: <value>Processor: <value>Installed RAM: <value>Operation System: <value>Graphics card: <value>Computer Name: <value>Domain Name: <value>MachineID: <value>Product Key:User Name: <value>Admin Group: <value>Integrity: <value>TimeZone: <value>UserLanguage: <value>Keyboard Language: <value>Display Resolution: <value>
