Redirected

Overview

Behavior:Win32/Redirected is a severe **Heuristic Detection** that flags unauthorized changes to the system's network configuration aimed at intercepting, monitoring, or manipulating outbound web traffic. This behavior is typically exhibited by advanced adware, banking trojans, and sophisticated Man-in-the-Middle (MitM) spyware attempting to capture credentials or inject malicious content into legitimate websites.

Understanding Redirected (Traffic Proxying)
To an end-user, this behavior might manifest as SSL certificate errors on usually secure sites (like banks), inexplicably slow browsing speeds, or an overwhelming number of injected advertisements on legitimate pages. For a security analyst, a Redirected alert indicates a critical breach of network integrity (`T1562.004`). The malware has successfully positioned itself between the user's browser and the internet.

Execution and Hijacking Mechanics
Malware triggers this detection through several techniques. It may modify the system-wide Windows Proxy Settings via the Registry (`T1112`), forcing all browser traffic through a locally hosted proxy server controlled by the malware. Alternatively, it might install a malicious Root Certificate Authority (CA) into the Windows Certificate Store (`T1553.004`), allowing the local proxy to seamlessly decrypt, inspect, and re-encrypt HTTPS traffic (TLS inspection) without triggering browser warnings. The malware can then steal credentials or inject banking trojan 'web injects' (`T1185`).

Indicators of Compromise & Impact
The impact is a total loss of confidentiality for all web traffic originating from the endpoint. Host-based IoCs include EDR alerts for modifications to `HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer`, the unexpected installation of new Root Certificates, or unknown processes listening on local ports (like `127.0.0.1:8080`). Network IoCs might include all outbound HTTP/HTTPS traffic routing to a single, unexpected external IP address.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_REDIRECTED {
    meta:
        description = "Detects Redirected (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "redirected" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Redirected Activity
id: da51e571aba719ebb61dde8876d485b3
status: experimental
description: Detects generic indicators of the redirected malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*redirected*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint; all communications, including credentials typed into secure websites, are actively being intercepted.
2. Open the Windows Internet Options and manually disable any unauthorized proxy server settings.
3. Audit the Windows Certificate Manager (`certmgr.msc`) and remove any suspicious or recently installed Root Certificate Authorities.
4. Initiate an enterprise-wide password reset for the user, assuming all recently used credentials have been compromised via the MitM attack.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user to log into any corporate portals until the proxy settings and rogue certificates are completely removed.
2. Avoid assuming a simple AV scan will fix the issue; AVs often miss the rogue Root Certificates which must be removed manually.

References & External Analysis

• Search "redirected" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Netwiredrc
• Delphi
• Expressdownloader
• Cambot
• Remexi

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/redirected.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.