RedosdruMalware
Redosdru is a malware family that primarily acts as a downloader. Upon execution, it may drop downloaded DLLs in the "%ProgramFiles%\AppPatch" directory. The malware modifies the Windows registry to ensure its persistence, adding entries to run automatically at system startup.From MISP Galaxy
Last reported 9 years ago, by Huntress2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1110Brute Force
“The hackers used this knowledge to their advantage and launched a brute force attack with commonly used passwords.”
- T1219Remote Access Tools
“During this incident, we discovered the attackers downloaded all sorts of nastiness including crimeware, remote access tools, and cryptocurrency miners.”
What the reports say
2 reports, newest first · the exact sentence from each-
Deep Dive: Squashing an MSSQL Attack“Redosdru — Encrypted DLL Payloads to Avoid On-Disk Signatures”
-
Redosdru — Encrypting DLL Payloads to Avoid On-Disk Signatures“Redosdru — Encrypting DLL Payloads to Avoid On-Disk Signatures”
Indicators in its reports
named in the reports above- e62d433e662bff74…127445f337e1in 2 reports
- 3edfe93173f368fe…6cc9aac090d1in 1 report
- hxxp://xiqiao2.f3322[.]orgin 1 report
- xiqiao2.f3322[.]orgin 1 report
- 3394755e45b6cba8…23e85f67e987in 1 report
- fyunf.f3322[.]netin 1 report
- 42.51.33[.]115in 1 report
- 420bdfbd9df77731…182bbe77d004in 1 report
- a603f7ceb5f80069…40602b939406in 1 report
- ed756c1cd9167690…7d847bfd176ein 1 report
- 477d7ad7fc262f16…3f3d441e83e2in 1 report
- 42a0e84845714ee1…51c0534e6a53in 1 report
- 748e5d31dfd30eeb…bbfdb01b74ecin 1 report
- 085ba2ddcae15e2d…7c7e4352428ein 1 report
- 4187894e15916bb5…2821d42a5babin 1 report
- 14.152.95[.]39in 1 report
- 23.238.133[.]194in 1 report
- 49.4.135[.]126in 1 report
- 49.4.135[.]223in 1 report
- 49.4.142[.]49in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.