RedCore
Description
(Kaspersky) When inspecting the NewCore RAT malware delivered during the various attacks we investigated, we were able to distinguish between two variants. Both were deployed as side-loaded DLLs and shared multiple similarities, both in code and behavior. At the same time, we noticed differences that indicate the variants could have been used by different operators.
Our analysis shows that the underlying pieces of malware and the way they were used form two clusters of activity. As a result, we named the variants BlueCore and RedCore and examined the artifacts we found around each one in order to profile their related clusters.
Names
| Name |
|---|
| RedCore |
Category
Malware
Type
- Backdoor
- Downloader
- Info stealer
- Keylogger
Information
Other Information
Uuid
d9af543c-8b48-4294-b2e3-d64e91f6cc02
Last Card Change
2021-05-15