7a59512b84bcd4c313c5b09cf7380b876c13c601551983ba6148423b7026d573

General

Target
EDGEALERT Installers Zip.zip
Size 88.3MB
Sample260415-lcbfxaax3j
SHA256 7a59512b84bcd4c313c5b09cf7380b876c13c601551983ba6148423b7026d573
MD5 57e75d962698a2c0d44305dff963c0ef
SHA1 5fefb76be17c327cec7555fd7161d8817fbbd8d7
SHA512 892fd25c42f2f5a680b93c0df59443134bce15d559ecc4b899a5b54a9de88bb64f6290378ab7dce4620097f75e5cf51803357d2ee3f20c2d027521970f24b542
SSDEEP 1572864:+ZdTQgyq5NdI3zex20ZGiN7JvWpzyfrzjClLBnANDnVNJKiHGYBZdEQN0Xm:+vlI3k2gzJv6n/ANxNZVB8SJ
TLSH
T1DF18337BD95CAFAEF8296031C23BB28C55D9602784261826DB98DF15533B4C363B1EC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  EDGEALERT Installers/EdgeAlert Version 15.exe
- Size 35.2MB
- SHA256 e45dfeea3e1380c0e65b6825be4d471a64c9198b90d7af6228b2330ec6f2592d
- MD5 11e3cfe8eadd5f481412f6bf27d8c66c
- SHA1 87a2b21da331194ff041e282cf80472aee700919
- SHA512 4057115d0fef54b7df1323ed73a462eb578d18b38382d534b8a98cdbd421a7555cc7e592a8a16a8780f608174cd00665ec199ce59c9ac977d6b06640ae2cd593
- SSDEEP 786432:hv7NTr0lhqc2PcfoYhRpsJRSlIF2SfbHnql7qT+90m0d/:J7NvkoTkph3eulSDnqqE8/
- TLSH
  T17D87233077DBC137D6A52570A52D8BBE16AA7E728F7150CB93882E5E05B28C24731F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  EDGEALERT Installers/windowsdesktop-runtime-8.0.25-win-x64.exe
- Size 55.8MB
- SHA256 2b118648b91d43a773fce18a7e934e80f9aff590ee6500c221693074310a6cfe
- MD5 2f2b3b6edd03f1f38913cf017cc48563
- SHA1 5af2ef45b817c57ea68d9eec9fe5a9e23d87d481
- SHA512 044628141cb05423b7e3a819d3baf13cab75382174a1e528c9c00f9e93919fd2684d68b5d70293f69560316c3909c49be279290da22541ed130a91924842e8ad
- SSDEEP 1572864:e49UpJrfceIERNhmLtgJWLMTv55ha5NKBHTY0b8Lh:eBJr50cWL65ueBcKI
- TLSH
  T19AD73337E12487BAD9F52032F53AB1782E64A11552554922EBD8EF1D3B3A4C317F3A83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2