Colibri Loader

A loader sold as MaaS first seen in August 2021.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine Payload

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

suricata: ET MALWARE Win32/Colibri Loader Activity

suricata: ET MALWARE Win32/Colibri Loader Activity

suricata: ET MALWARE Win32/Colibri Loader Activity M2

suricata: ET MALWARE Win32/Colibri Loader Activity M2

suricata: ET MALWARE Win32/Colibri Loader Activity M3

suricata: ET MALWARE Win32/Colibri Loader Activity M3

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.