MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1305139a7ad70ad2c9af4c10be27e65da65b9273fe92c75b4ea8c6aa94e6c98d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Redosdru

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	1305139a7ad70ad2c9af4c10be27e65da65b9273fe92c75b4ea8c6aa94e6c98d
SHA3-384 hash:	462b2b258922b2ed7813d84ad990fe87c6f23c4de0b1a5621ef6ff203f72408c75a78b57e721f33f3e3ab577c8c0bc96
SHA1 hash:	44c2b34e007aaf763ea87d473a02149c8674d460
MD5 hash:	cf0baf59131698ee60b4f6031b44d901
humanhash:	vegan-blue-vermont-romeo
File name:	SecuriteInfo.com.Trojan.DownLoader19.23899.32209.21780
Download:	download sample
Signature	Redosdru Create hunting rule
File size:	28'672 bytes
First seen:	2020-12-19 08:34:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d3699e76643af2dad3cd1ed6c158247c (2 x Redosdru)
ssdeep	192:7esWmSl5tzohHFOpy0e0WqFktgWDf3fC2/dfCB7A1oyncm70ryArnjlZz42oZR5j:VA5Nojv0WqFkPfNq7A1SmoryOjHzzdU
Threatray	7 similar samples on MalwareBazaar
TLSH	58D2292AE69504B2DEC2D27016FF4E3D41B79D915BEC864F4748FD9C0D722D2AA1328E
Reporter	SecuriteInfoCom
Tags:	Redosdru

Intelligence

File Origin

# of uploads :

# of downloads :

242

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

run.exe

Verdict:

Malicious activity

Analysis date:

2020-12-17 08:32:38 UTC

Tags:

trojan dupzom

Link:

https://app.any.run/tasks/8f4420ee-4b5e-4a08-9742-f5950ebd0047

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/108524/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader19.23899.32209.21780.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending an HTTP GET request

Creating a file in the Program Files subdirectories

DNS request

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/566753

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to capture and log keystrokes

Contains functionality to detect sleep reduction / modifications

Contains functionality to infect the boot sector

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1305139a7ad70ad2c9af4c10be27e65da65b9273fe92c75b4ea8c6aa94e6c98d/

Threat name:

Win32.Trojan.Redosdru

Status:

Malicious

First seen:

2020-12-18 07:12:00 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cmcrhgt224fnfsnpjqil4j7glwtfxett72jmow2ovddkvfhgzggq._file

Verdict:

unknown

Redosdru

42a6d451a9ec369df0b51fe9f96dad2bc8c04ce3df95c93ec5ae7ef0139d903d

Redosdru

82c8c241387c128a1d00eb9a96ec415ccad32461600441cb9a6c9176cfebd617

Redosdru

851f2df17ce8673bc0747d4ec64b2904b3749a5e9028acbc65db70613b3e5ad5

Redosdru

a66d1021e54269963e9a54892869d569ffa1c74d9fb1b67f023ea5fdfd90c1a6

Redosdru

bea67778fa9a788b8137fb623d045d2b90011f806ddc38212d9f4d877ab8d49a

Redosdru

c96fb748304f35220cae69a622318ee3e425802dea7387549af4add7ba449b7e

Redosdru

Result

Malware family:

n/a

Score:

8/10

Tags:

upx

Link:

https://tria.ge/reports/201219-trpw9czzy2/

Behaviour

Drops file in Program Files directory

UPX packed file

Unpacked files

SH256 hash:

1305139a7ad70ad2c9af4c10be27e65da65b9273fe92c75b4ea8c6aa94e6c98d

MD5 hash:

cf0baf59131698ee60b4f6031b44d901

SHA1 hash:

44c2b34e007aaf763ea87d473a02149c8674d460

Link:

https://www.unpac.me/results/afea97f2-64e9-47ad-a9ec-51876261e3c7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Magania

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1305139a7ad70ad2c9af4c10be27e65da65b9273fe92c75b4ea8c6aa94e6c98d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CN_disclosed_20180208_Mal1 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details

Rule name:	GhostDragon_Gh0stRAT_Sample3 Create hunting rule
Author:	Florian Roth
Description:	Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report
Reference:	https://blog.cylance.com/the-ghost-dragon

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/