RedLine: distributed with crypters
RedLine Stealer profileRedLine was mostly distributed inside a crypter, disguised as unlicensed software and fake installers. Zscaler
A tool that encrypts malware and hides it inside a loader, so that the file on disk does not match antivirus signatures.
A crypter encrypts or compresses the actual malware and embeds it in a small loader that decrypts it in memory when run. The file seen on disk is completely different from the payload inside. MITRE ATT&CK
Infostealer sellers and customers buy crypting as a separate service; the same family arrives in a different shell in each campaign. MITRE ATT&CK
The malware is encrypted and embedded in the loader as a data block. MITRE ATT&CK
When the user opens the file, the loader decrypts the block in memory. MITRE ATT&CK
The decrypted code is often placed inside a legitimate process; it may never be written to disk. MITRE ATT&CK
RedLine was mostly distributed inside a crypter, disguised as unlicensed software and fake installers. Zscaler
The multi-stage loader of PureLogs hid the actual payload inside a PNG file. Swiss Post Cybersecurity
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy