Investigation of Malware Redline Stealer Using Static and Dynamic Analysis Method Forensic

Abstract

Redline Stealer is a malware variant discovered in early March 2020 by proof point analyst. Redline is famous for its ability to bypass the antivirus scan. Redline Stealer was created by hacker with the purpose to steal victim’s information such as login data, password and credit card information from the browser application that used in infected computer. This research uses static and dynamic method to analyze redline stealer. The process of static analysis is carried out by observing the malware’s sample file, while dynamic analysis is carried out by monitoring malware’s activity when the malware is running on the system. In this research show that Redline Stealer is uses the obfuscation feature, based on .net, can run only when there is internet connection, stealing sensitive information especially in browser application. The conclusion of this research is Redline Stealer can be classified as a stealer malware that can steal important data on the infected system. The result of the analysis using the strings extract and decompile did not find any information because this malware uses the obfuscation feature, so the static analysis did find fewer information than the dynamic method.