Trojan:Win32/Redosdru.E (file analysis)

The Trojan:Win32/Redosdru.E is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Redosdru.E virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Redosdru.E?

File Info:
name: 737C2AE293F7B2B38C81.mlw
path: /opt/CAPEv2/storage/binaries/58282136d468b82b291b82c969316c7d04489b9764c2f6bbc9c67aeb7437c74e
crc32: CF158B78
md5: 737c2ae293f7b2b38c81c0acceeeb904
sha1: f1211b54fa522618617b73d839809534900471a0
sha256: 58282136d468b82b291b82c969316c7d04489b9764c2f6bbc9c67aeb7437c74e
sha512: 3f4d0a6d10d1b1ffc8fcc3890f35fb22e572d24119650bd608dc46de4e86ca89744228ee1f110aee91bbadc8bcd1f18665daa6cfea57608dc65ee9496db0b86a
ssdeep: 24576:yd8Jm/O6RN/dVW+QjLCns/pbTKZwhqpCiFB2828p5D:/Gdg+cCnsRbTAwhril5D
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13E15234897284E83D4584E3DC22703E77BE4FF184B0860762586D84B7CCE67E657A9FA
sha3_384: fed10a1a56f36394c5f37e4d55dd4b8a9180064b04285ce98776dec5129db05bb2cb72c87b4f9471fb26caf4f4daf602
ep_bytes: 5033c056515253570f8420ffffffb3d9
timestamp: 1972-12-25 05:33:23

Version Info:
0: [No Data]

Trojan:Win32/Redosdru.E also known as:

How to remove Trojan:Win32/Redosdru.E?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.