APT29 Tag Doesn't Fit This Commodity RedLine/ClipBanker Cluster
A DevExpress "patch and keygen" lure has circulated for at least four years, and shared imphashes, packers, and YARA hits tie it to a ClipBanker dropper pair, a RedLine/njRAT cohort, and a ServiceHub-masquerading payload set. All four clusters phone home to one dynamic-DNS domain fronted by a default, self-signed VPS certificate.
A DevExpress-branded "patch and keygen" tool for pirated developer software has been circulating for at least four years, and CTX Team's review of the build artefacts shows it was never a one-off release. Two files trading on that exact branding — a 159KB tool named DevExpress_Patch_Keygen_DFoX.exe (c5460701f45d70e8b7255195ee08d15d87aa7847562ca27a6b5cd0c803418f5d) and a 6.4MB dropper named DevExpressPatch.exe (ebe9cb6a4e6bf1285e1cd120ca031e3f8d7fab938e1122579cfb49735d3db81d) — share an…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read