MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81d6978af7320d1e0631ffaa3b976b16f3475b235a9c072b88fb82dae0ad6b14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Redosdru


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81d6978af7320d1e0631ffaa3b976b16f3475b235a9c072b88fb82dae0ad6b14
SHA3-384 hash: 68db0b3e1ce716c50f326b126d182ea31a48e8d1d67fafcea2b7537f10d418f159aec0fd1ea7e5ad7ea7dccf7fbe2573
SHA1 hash: 7a762c618babae452cfd614dcd141d65a6c6baf4
MD5 hash: 22f4f84a54b8de13384ea8e47aa63c95
humanhash: nineteen-princess-chicken-bluebird
File name:Dh2.exe
Download: download sample
Signature Redosdru
Create hunting rule
File size:102'818 bytes
First seen:2021-03-17 00:07:55 UTC
Last seen:2021-03-17 01:49:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 73ec795c6c369c6ce2c3b4c3f6477daa (12 x Gh0stRAT, 5 x MimiKatz, 1 x Redosdru)
ssdeep 1536:1LySvNVtEFvcEUjR3kuh/o3fr1LCF/lc5AyDd7ARfypevpwST92O0kCM:PPtEFEES0uhg1LCNlcdG7pwI0O
Threatray 26 similar samples on MalwareBazaar
TLSH B1A3F123B9A8D0D6D538017FDC8AE269D13FB362DF569D83BBD8234F28614C5D0550EA
Reporter r3dbU7z
Tags:exe Redosdru

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Dh2.exe
Verdict:
Malicious activity
Analysis date:
2021-03-17 00:09:41 UTC
Tags:
trojan dupzom servstart
Link:
https://app.any.run/tasks/bc816c61-7fc7-4e93-b6c9-249ba822d33b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/124459/
Detection(s):
PUA.Win.Trojan.Molebox-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending an HTTP GET request
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Creating a service
Launching a service
Sending a UDP request
Delayed reading of the file
Sending a custom TCP request
Enabling autorun for a service
Deleting of the original file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Njw0rm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6406d546-95e9-468c-a4ba-6c89320aa374
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/641546
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81d6978af7320d1e0631ffaa3b976b16f3475b235a9c072b88fb82dae0ad6b14/
Threat name:
Win32.Trojan.Redosdru
Create hunting rule
Status:
Malicious
First seen:
2021-03-02 11:30:00 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qhljpcxxgigr4brr76vdxf3lc3zuowzdlkoaok4i7obnvyfnnmka._file
Verdict:
unknown
Similar samples:
1305139a7ad70ad2c9af4c10be27e65da65b9273fe92c75b4ea8c6aa94e6c98d
Redosdru
420c4a968b184211b9e5e2d26b5a460229249a6fbc5a3dbdba6b5096e4903b63
Redosdru
50e90a38a2fda1a8a9c6ea93d9aafcb9a97271abf485b778a307e177e670ad4d
Redosdru
7d74db6d7705d15a9a3e25989d7c2983ff9ae2d4fbe561bc8a020c37eb3e2d3b
Redosdru
82c8c241387c128a1d00eb9a96ec415ccad32461600441cb9a6c9176cfebd617
Redosdru
851f2df17ce8673bc0747d4ec64b2904b3749a5e9028acbc65db70613b3e5ad5
Redosdru
9f905e04970d3c86d99ddb67052f2f948605a26891d085d1ab431a693260e155
Redosdru
b19f2c2eec099ce6116313fff9348927a979584c82338f16c4f24231100dbd4b
Redosdru
d494d1c9597021407f9167547604c663e7f70f705b5e70bfa207d346d9de7ae9
Redosdru
f2e9b563cfb903599a87072f6f36d77c02eb4a9c885e7c8da435f4f02801ad15
Redosdru
+ 16 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210317-7kdjeys9mn/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Enumerates connected drives
Deletes itself
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
ee33a7e0b05a390aa941ccd8b2a496c0d0daeb7db1a467aa020b3e51d4177bd2
MD5 hash:
e264472ab34552768869964c28402042
SHA1 hash:
1806d7a3654cb04f6c64fba4c0af1d68cb3e4baa
Link:
https://www.unpac.me/results/177c9daa-4908-42cd-a59d-d1a119f64a80/
SH256 hash:
81d6978af7320d1e0631ffaa3b976b16f3475b235a9c072b88fb82dae0ad6b14
MD5 hash:
22f4f84a54b8de13384ea8e47aa63c95
SHA1 hash:
7a762c618babae452cfd614dcd141d65a6c6baf4
Link:
https://www.unpac.me/results/177c9daa-4908-42cd-a59d-d1a119f64a80/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redosdru
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/81d6978af7320d1e0631ffaa3b976b16f3475b235a9c072b88fb82dae0ad6b14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/124459/

Comments