⚠️ Overview

RedTiger Stealer is an information-stealing malware first documented in early 2023 by cybersecurity firm Cyble after researchers identified it being distributed via malicious YouTube tutorials. This stealer is written in C# and operates as a commodity malware available on underground forums, targeting credentials, browser data, cryptocurrency wallets, and gaming accounts. It is categorized as an infostealer within the broader credential-theft and data-exfiltration malware ecosystem.

🔧 Technical Capabilities

The malware leverages multiple attack vectors: it is typically delivered through phishing emails containing fake software cracks or through fake download links on video platforms. Once executed, RedTiger Stealer enumerates the victim’s system using WMI queries and collects data from browsers (Chrome, Firefox, Edge, Opera) by parsing local SQLite databases for saved passwords, cookies, and autofill information. It also targets cryptocurrency wallets such as Exodus, Electrum, and MetaMask by scanning wallet directories and copying seed phrases. The stealer exfiltrates stolen data over HTTP POST requests to a command-and-control (C2) server; early samples used a Telegram bot API to forward collected data. Persistence is achieved by adding a registry Run key, and evasion includes obfuscation via ConfuserEx and checking for sandbox or debugging tools to delay execution.

📜 History & Notable Incidents

RedTiger Stealer gained notoriety in mid-2023 when a campaign using fake game cheat videos on YouTube led to the compromise of over 10,000 victims within a month, according to Cyble’s July 2023 analysis. No specific high-profile corporate victims have been publicly named, but the malware has been linked to attacks against individual gamers and cryptocurrency users. No known CVEs are associated with the stealer itself; it exploits user behavior rather than software vulnerabilities. Law enforcement actions have not been reported, but the malware’s source code was leaked on a Russian-language hacking forum in late 2023, increasing its use by lower-tier threat actors.

🔍 Detection Indicators

Known file hashes for RedTiger Stealer include SHA256 values published in Cyble’s report (e.g., 5f1c3b8a...); however, hashes change rapidly with new builds. Behavioral indicators include the creation of files in %TEMP% named with random characters, registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun, and outbound HTTP connections to IPs associated with Telegram API endpoints. The User-Agent string often appears as a generic Mozilla/5.0 (Windows NT 10.0; Win64; x64) but with unusual HTTP headers like “X-Client: RedTiger.” Mutex names typically follow the pattern “GlobalRedTiger_{random}”.

☠️ Risk & Impact

The primary damage from RedTiger Stealer is data exfiltration: stolen credentials can lead to account takeover, identity theft, and cryptocurrency loss. For individual users, financial losses from emptied wallets and drained gaming accounts have been reported. The malware primarily affects the consumer and gaming sectors, though any organization whose employees fall victim may face credential-based intrusions. Because it does not encrypt files or demand ransom, financial impact is indirect but can be severe for targeted cryptocurrency holders.

🛡️ Mitigation

Defenders should enforce application allowlisting and block execution from %TEMP% directories, deploy endpoint detection rules (e.g., Sigma rules for suspicious registry Run keys and Telegram API outbound connections), and educate users to avoid downloading software from unverified video tutorials. Network-level blocking of known Telegram Bot API domains and IPs associated with RedTiger C2 infrastructure, as listed in Cyble’s IoC feeds, is recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.