Redator

Category: trojan · Aliases: Trojan.Redator, PasswordStealer.Redator, Win32/Redator · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-01T16:31:29Z

Category: TrojanActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Redator is a sophisticated Information Stealer (InfoStealer) and Trojan designed to silently harvest sensitive credentials, session tokens, and financial data from compromised Windows endpoints. Often distributed via targeted spam campaigns, Redator acts as an automated data exfiltration tool, directly contributing to account takeovers and broader enterprise breaches.

Infection Vector and Extraction Methodology

Redator is heavily distributed via mass malspam campaigns. The phishing emails frequently utilize socially engineered lures (e.g., fake invoices or shipping manifests) containing malicious attachments—such as weaponized Excel documents, ISO images, or obfuscated VBScript droppers. Upon execution, Redator performs rapid, automated data extraction:

Credential Theft: It systematically targets the internal databases of major web browsers (Chrome, Firefox, Edge), FTP clients, and email clients, extracting saved passwords, autofill data, and active session cookies.
System Profiling: Redator gathers deep system telemetry, including hardware identifiers, installed software lists, and network configurations, which helps attackers profile the value of the compromised host.
Data Exfiltration: The stolen intelligence is aggregated, compressed, and covertly transmitted to the attacker's command-and-control (C2) server via HTTP POST requests, effectively bypassing basic perimeter defenses.

Security and Privacy Implications

A Redator infection is a critical security breach resulting in the immediate compromise of both corporate and personal credentials. This stolen intelligence is frequently used by the attackers to pivot laterally into corporate networks (via VPN or RDP) or sold on dark web marketplaces.

Incident Response and Mitigation

Credential Invalidation: Immediate, organization-wide password resets are mandatory following a confirmed Redator infection. All active session tokens and VPN access keys must be forcibly revoked.
Endpoint Detection and Response (EDR): Deploy EDR solutions configured to alert on processes attempting unauthorized, bulk access to browser profile directories and the `CryptUnprotectData` API.
Email Security: Implement strict email filtering and sandboxing to block malicious attachments before they reach the end-user, disrupting the primary distribution vector.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1555.003 T1003 T1048.003

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

T1003: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_REDATOR {
    meta:
        description = "Detects Redator (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "redator" ascii wide nocase
        $s2 = "trojan.redator" ascii wide nocase
        $s3 = "passwordstealer.redator" ascii wide nocase
        $s4 = "win32/redator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Redator Activity
id: eab9e1f8e8c7421c149be0fd8cae0114
status: experimental
description: Detects generic indicators of the redator malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*redator*"
            - "*trojan.redator*"
            - "*passwordstealer.redator*"
            - "*win32/redator*"
    condition: selection
level: medium

References & External Analysis

Search "redator" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Redator Trojan from Windows?

Manual removal of Redator is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Redator a virus or a Trojan?

Redator is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Redator typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Redator infection?

Symptoms of Redator can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: trojan)

Explore other malware families in the same category:

Protect Your Network Against Trojans

Want to prevent Redator and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/redator.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.