Colibri Loader

A loader sold as MaaS first seen in August 2021.

RedLine

RedLine Stealer is a malware family written in C#, first appearing in early 2020.

RedLine payload

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)

suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Win32/Colibri Loader Activity

suricata: ET MALWARE Win32/Colibri Loader Activity

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.