Redosdru — Encrypting DLL Payloads to Avoid On-Disk Signatures

Malware analysis documents a UPX-packed dropper (wshom.exe) that retrieves an encrypted NetSyst88.dll from http://xiqiao2.f3322.org:2014, decrypts it in memory, and loads an implant (linked to Redosdru) capable of keystroke logging, user/group manipulation, process killing and clipboard theft; analysis includes SHA256 hashes and network IOCs validated with ProcMon and Wireshark.