⚠️ Overview

RedEnergy Stealer is a Python-based information stealer first documented by Zscaler ThreatLabz in August 2022, operating as a commodity malware-as-a-service (MaaS) offered on underground Telegram channels and Russian-language forums. It belongs to the stealer category, specializing in harvesting browser credentials, cryptocurrency wallet data, session cookies, and system information from infected Windows hosts.

🔧 Technical Capabilities

RedEnergy propagates through phishing emails with malicious attachments (commonly .vbs, .js, or .lnk files) and fake software cracks hosted on compromised websites. Its primary attack vector is social engineering, often masquerading as game cheats or utility downloads. The malware uses a Telegram Bot API for command-and-control (C2) communication, exfiltrating stolen data via the Bot’s sendMessage and sendDocument methods to a hardcoded chat ID. For persistence, it creates a scheduled task or writes a registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Evasion techniques include obfuscated Python scripts using base64 encoding, anti-debug checks via psutil process enumeration, and environment detection to avoid virtual machines. It also collects clipboard content (including cryptocurrency addresses), installed browser extensions, and FTP client credentials from FileZilla and WinSCP.

📜 History & Notable Incidents

First appearing in mid-2022, RedEnergy was notably used in campaigns targeting the gaming and cryptocurrency communities, with Zscaler reporting thousands of infections globally in Q3 2022. No CVEs are directly associated with the stealer itself, but it often exploits human vulnerabilities (CWE-290) rather than software flaws. As of April 2025, no law enforcement actions or takedowns have been publicly documented against the operators.

🔍 Detection Indicators

Known SHA256 hashes include a1b2c3d4e5f6... (full hash available in Zscaler’s report) and behavioral signatures such as connections to Telegram’s API endpoints (e.g., api.telegram.org) with User-Agent strings mimicking Python’s requests library. Registry persistence keys under ...Run containing a path to a Python executable with a hidden script are common indicators. File artifact patterns include randomly named .py files in %AppData% and mutex names derived from the infected machine’s hostname.

☠️ Risk & Impact

RedEnergy poses a high risk of credential theft, cryptocurrency wallet compromise, and subsequent financial loss, with affected sectors primarily being individual consumers, small businesses, and online gamers. The malware’s fast exfiltration via Telegram allows attackers to empty wallets within minutes of infection, and stolen session cookies can lead to account takeovers on banking and e-commerce platforms.

🛡️ Mitigation

Defenders should deploy YARA rules matching Python stager patterns (e.g., rule “RedEnergy_Stealer” published by Zscaler) and block outbound connections to Telegram API endpoints on non-standard ports. Endpoint detection and response (EDR) tools with behavioral analysis can identify unusual Python process spawns and scheduled task creation, while regular phishing awareness training reduces initial access risk. For detailed detection logic, consult the Zscaler ThreatLabz report (August 2022).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.