{
  "family": "redaman",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nRedaman is a highly sophisticated Banking Trojan that primarily targets financial institutions, payment processors, and corporate banking portals, historically focusing heavily on the Russian and Eastern European financial sectors. Evolving from earlier banking trojans (and sharing code similarities with the RTM banking trojan), Redaman is engineered for massive financial theft, utilizing advanced evasion techniques and localized man-in-the-browser (MitB) attacks.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRedaman is predominantly distributed via highly targeted, localized spear-phishing campaigns. These emails often contain weaponized attachments (such as malicious PDF files or Word documents with macro exploits) or deceptive links disguised as urgent financial invoices or tax documents.\n\nOnce executed, Redaman deploys a multi-stage infection process:\n<ul>\n<li><strong>Evasion and Anti-Analysis:</strong> Redaman is notorious for its anti-analysis checks. Before executing its primary payload, it verifies the default system language (often terminating if the system is not using a targeted language like Russian), checks for the presence of virtual machines (VMware, VirtualBox), and attempts to detect active debugging tools.</li>\n<li><strong>Web Injection and Credential Theft:</strong> The core functionality relies on Man-in-the-Browser (MitB) attacks. Redaman hooks into web browsers to intercept traffic, injecting malicious HTML/JavaScript into legitimate banking websites. This allows it to steal login credentials, intercept two-factor authentication (2FA) SMS codes, and silently alter transaction details in real-time.</li>\n<li><strong>Clipboard and Keystroke Logging:</strong> The trojan actively monitors the system clipboard for cryptocurrency wallet addresses and logs all keystrokes to capture sensitive data outside of the browser environment.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Redaman infection is a critical, high-impact security incident. It represents a direct, immediate threat of massive financial loss, corporate account takeover, and severe regulatory compliance breaches for the affected organization.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Immediate Network Containment:</strong> The infected machine must be immediately physically disconnected from the network to halt active financial data exfiltration and prevent the trojan from pivoting to other high-value targets (like financial controllers).</li>\n<li><strong>Financial Account Lockdown:</strong> Immediately notify the organization's financial institutions to freeze all associated corporate accounts and closely monitor for unauthorized wire transfers or ACH transactions.</li>\n<li><strong>System Wipe and Re-image:</strong> Due to Redaman's deep system hooks and advanced persistence mechanisms, attempting to clean the infection is highly risky. The only guaranteed method of eradication is a complete wipe and re-image of the compromised host from a known good baseline.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan-Banker.Win32.Redaman",
    "Banker.RTM",
    "Win32/Redaman"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1185",
    "T1114",
    "T1056.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:39:01Z",
  "type": "Banking Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}