Redaman

Category: trojan · Aliases: Trojan-Banker.Win32.Redaman, Banker.RTM, Win32/Redaman · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-01T16:39:01Z

Category: TrojanActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Redaman is a highly sophisticated Banking Trojan that primarily targets financial institutions, payment processors, and corporate banking portals, historically focusing heavily on the Russian and Eastern European financial sectors. Evolving from earlier banking trojans (and sharing code similarities with the RTM banking trojan), Redaman is engineered for massive financial theft, utilizing advanced evasion techniques and localized man-in-the-browser (MitB) attacks.

Infection Vector and Technical Capabilities

Redaman is predominantly distributed via highly targeted, localized spear-phishing campaigns. These emails often contain weaponized attachments (such as malicious PDF files or Word documents with macro exploits) or deceptive links disguised as urgent financial invoices or tax documents. Once executed, Redaman deploys a multi-stage infection process:

Evasion and Anti-Analysis: Redaman is notorious for its anti-analysis checks. Before executing its primary payload, it verifies the default system language (often terminating if the system is not using a targeted language like Russian), checks for the presence of virtual machines (VMware, VirtualBox), and attempts to detect active debugging tools.
Web Injection and Credential Theft: The core functionality relies on Man-in-the-Browser (MitB) attacks. Redaman hooks into web browsers to intercept traffic, injecting malicious HTML/JavaScript into legitimate banking websites. This allows it to steal login credentials, intercept two-factor authentication (2FA) SMS codes, and silently alter transaction details in real-time.
Clipboard and Keystroke Logging: The trojan actively monitors the system clipboard for cryptocurrency wallet addresses and logs all keystrokes to capture sensitive data outside of the browser environment.

Threat Assessment

A Redaman infection is a critical, high-impact security incident. It represents a direct, immediate threat of massive financial loss, corporate account takeover, and severe regulatory compliance breaches for the affected organization.

Remediation and Eradication

Immediate Network Containment: The infected machine must be immediately physically disconnected from the network to halt active financial data exfiltration and prevent the trojan from pivoting to other high-value targets (like financial controllers).
Financial Account Lockdown: Immediately notify the organization's financial institutions to freeze all associated corporate accounts and closely monitor for unauthorized wire transfers or ACH transactions.
System Wipe and Re-image: Due to Redaman's deep system hooks and advanced persistence mechanisms, attempting to clean the infection is highly risky. The only guaranteed method of eradication is a complete wipe and re-image of the compromised host from a known good baseline.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1056.001 T1185 T1114 T1056.004

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_REDAMAN {
    meta:
        description = "Detects Redaman (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "redaman" ascii wide nocase
        $s2 = "trojan-banker.win32.redaman" ascii wide nocase
        $s3 = "banker.rtm" ascii wide nocase
        $s4 = "win32/redaman" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Redaman Activity
id: e7c844abf419056ba0820d746a8c2a7b
status: experimental
description: Detects generic indicators of the redaman malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*redaman*"
            - "*trojan-banker.win32.redaman*"
            - "*banker.rtm*"
            - "*win32/redaman*"
    condition: selection
level: medium

References & External Analysis

Search "redaman" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Redaman Trojan from Windows?

Manual removal of Redaman is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Redaman a virus or a Trojan?

Redaman is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Redaman typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Redaman infection?

Symptoms of Redaman can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: trojan)

Explore other malware families in the same category:

Protect Your Network Against Trojans

Want to prevent Redaman and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/redaman.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.