Spy

What is “Spyware.RedLineStealer”?

Malware Removal

The Spyware.RedLineStealer is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Spyware.RedLineStealer virus can do?

  • The executable is likely packed with VMProtect
  • Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Spyware.RedLineStealer?



File Info:

crc32: 541D770E
md5: b4f0c3fbc921110f48bb5a3cdebd3031
name: 684421763570137584727018145813828204.exe
sha1: d8832f4e00967d591833e4851d4fc4aceadceaa8
sha256: f4cbe989b9e81ecff7093c6ad09bc1491edde870bf5959cf888a799ca5f2caf0
sha512: 7912dbfbbc75105f7e642df877991bff74347cff15b65672f93840cb745ee6ac2837a5cbabf2be096737d970f6d1962a605566b5c0598766c6d194094c49e7c5
ssdeep: 24576:1vyB0WLoB7eO8nuU7cxc1f0C9oB7eO8nuU7cxcx:U/LoBxE/9oBxE
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows


Version Info:

Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2019 HuqqaMr ltd
Assembly Version: 1.0.2.0
InternalName: VVVeDRn.exe
FileVersion: 1.0.2.0
CompanyName: HuqqaBaz TR.
LegalTrademarks: 
Comments: Cafe Management
ProductName: CafeManagement Prdt
ProductVersion: 1.0.2.0
FileDescription: Cafe Management
OriginalFilename: VVVeDRn.exe

Spyware.RedLineStealer also known as:

MicroWorld-eScanTrojan.GenericKD.42879778
FireEyeGeneric.mg.b4f0c3fbc921110f
McAfeeArtemis!B4F0C3FBC921
VIPRETrojan.Win32.Generic!BT
AegisLabTrojan.Win32.Malicious.4!c
SangforMalware
BitDefenderTrojan.GenericKD.42879778
Cybereasonmalicious.e00967
BitDefenderThetaGen:NN.ZemsilF.34104.Mv0@aqCC8qj
CyrenW32/MSIL_Agent.BED.gen!Eldorado
SymantecML.Attribute.HighConfidence
TrendMicro-HouseCallTROJ_GEN.R023H0CCO20
AvastWin32:PWSX-gen [Trj]
GDataTrojan.GenericKD.42879778
KasperskyHEUR:Trojan-Spy.MSIL.Stealer.gen
AlibabaTrojanSpy:MSIL/Stealer.01a86bc4
RisingSpyware.Stealer!8.3090 (CLOUD)
Endgamemalicious (high confidence)
SophosMal/Generic-S
F-SecureTrojan.TR/Spy.Stealer.zbqnt
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Virut.tm
Trapminemalicious.high.ml.score
EmsisoftTrojan.GenericKD.42879778 (B)
IkarusTrojan.SuspectCRC
F-ProtW32/MSIL_Agent.BED.gen!Eldorado
JiangminTrojanSpy.MSIL.aobm
AviraTR/Spy.Stealer.zbqnt
MicrosoftTrojan:Win32/Bomitag.D!ml
ArcabitTrojan.Generic.D28E4B22
ZoneAlarmHEUR:Trojan-Spy.MSIL.Stealer.gen
ALYacTrojan.GenericKD.42879778
MAXmalware (ai score=88)
Ad-AwareTrojan.GenericKD.42879778
MalwarebytesSpyware.RedLineStealer
PandaTrj/GdSda.A
APEXMalicious
ESET-NOD32a variant of MSIL/Kryptik.VFB
TencentMsil.Trojan-spy.Stealer.Phpw
SentinelOneDFI – Malicious PE
FortinetMSIL/Stealer.JJCIZHZ!tr
WebrootW32.Trojan.Gen
AVGWin32:PWSX-gen [Trj]
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_90% (W)
Qihoo-360Generic/Trojan.Spy.67f

How to remove Spyware.RedLineStealer?

Spyware.RedLineStealer removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment