9e0cf8b587133096a48aaf91870a9e15640e9026650c8d41005fcf13598669ba

Sharing

Copy URL Twitter E-mail

General

Target
ED Dashboard.zip
Size 2.2MB
Sample261002-g8r2basemf
SHA256 9e0cf8b587133096a48aaf91870a9e15640e9026650c8d41005fcf13598669ba
MD5 ba92e539d7d066f651815e928672085d
SHA1 f49c0ca4c17dc3e4c4c4d12ea235f1a6663f6136
SHA512 1708d12c996a2f70f85f937a43b43ec5f29cefd3da0f46a670bb669be23232245fdd34fe885c86de46d780d165de312caefc7d45bc9a9d6e942186dc0b82c25b
SSDEEP 49152:YwLbhKC/r05/RPvRVqa7ZMLRyVFe7+33NLMIvapPC9/LEq:YtC/ri/B6a7Ggg7+3Mpq
TLSH
T166B5331DF1EBB6308487E377454934F4BC2D164B16AACF39B0E9AA4DC041FD660A561F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ED Dashboard/ED-Dashboard.exe
- Size 101KB
- SHA256 d72294fb338bc2fc8896d25a7395a4db466425427e1559e77185d5135a830681
- MD5 72afbe203882951dc77a5cf6dcc07ffe
- SHA1 e42f23434e8323d695cb249e686692794dba385e
- SHA512 426dc0e1ab31b895f7b5ef04ee4be52f562c03e856bda4569cd7052fe0aa3f15404f240f73bf8d2bb5e87240aa6671fdf8601d8b52e3b21a858a7f2e21b089dd
- SSDEEP 1536:Csef7hIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/T5sCytH/9wfIW44zqrhO:CsOSwMpdCq/IM8uIGf1/T5sLW4IKh
- TLSH
  T1F5A30841E62DBDCDE508D4314A75D4F26D24ED727680A51EB7F37F0628312A3FA0A93A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  ED Dashboard/Start ED Server (macOS).command
- Size 544B
- SHA256 b30c9cda4f46c88f4bb4d866bfc3962435bbc6a1092abd51cdb8e5ed24e8d9d2
- MD5 4246e8bcf394640f9b269b2e206c7441
- SHA1 c958bffffd9a5fdddac9396da38b8c69bc32a6cb
- SHA512 467d2a7c162fa4e31e6e601ebd38d0d0ae362a1a07589314a028d6049868017d87f28302a665c2039838e008dcead0868b3b6d6c425a251dc3f11a5794fc3bd1
- TLSH
  T18BF0C001B12CC6F48EEA40DD2C41316973C63B9278493C8961F52FB0FAF896531B5724
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution persistence
- Drops desktop.ini file(s)
behavioral2
- Target
  ED Dashboard/ed-registration.html
- Size 395KB
- SHA256 189a551b5655d679cd617aee79ae2d84b340a5fda669b5c390cedfb85bb4ff04
- MD5 abd6551f78bb1fbdc8b0e04384818fff
- SHA1 b4e9c58564474891106acaab2d4e659b1f5f4654
- SHA512 0c93aab762ab4cc6f5819691c99dbfff2696c6d045b4ec9396a079110de8dc3ba5f39e4a2998df307a658c36e4d9b44646ef328db53fe4421622a4679070a0b2
- SSDEEP 6144:/n/nd88wAk1UFjBOh7/kH3lVf1Gk+MlEGYNL6oq8lsY:/fAyBOhZTMn11E
- TLSH
  T174845BE279E2203588B341E7619F42467868850BF94BE480FF6C5A504FC7F95A33F6AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  ED Dashboard/lib/edge-calc.js
- Size 626KB
- SHA256 a5391189d941eb1342421e96ed9f9b4ea85e93bab6d060603aafd4631d9999b9
- MD5 4b77e4b0d8520c9012308f4380e7610a
- SHA1 6dd4309c59f8cf3105060046c82164d6f73c4520
- SHA512 a8340673d740e4db0ee4d61782499e341934697567ca3c4dcb87de86b37c6983e9303641703edb2f1be593b1902928de795a7e47a4d8332d778c3a2433b6f02e
- SSDEEP 6144:f7O2oMgdlFQW8jRhjbkJNqOUuU0kD35mLrUy+m6lfAlF/iXNQND3VqBs4IoLqcXd:qV718jjkSOUuU0U1lolDjHoF
- TLSH
  T19ED43B9B5DD7323BC517E2758326BC119A6E4802C230A936BC4D826C6F8856CD37E9FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  ED Dashboard/lib/em-companion-data.js
- Size 1.3MB
- SHA256 d6d7a08d85ae4f5646dd4ac149682718327e1f94e7c8f447aa52fde283fe26c3
- MD5 1690d6512388826ba035613c0ca50453
- SHA1 a1e17139b7286edb02b05cd3e50cb4b1732a2323
- SHA512 d350abadc6e2646eab826718970a819d53b80677c451a49694b8ce2b5525dd387aa8daf089ffd7869cf74e8507b016713238195ba4e2ffe3f04e779a898ae120
- SSDEEP 24576:aEQ30qtao6vokJ+MOB1MmCk3dKpjYaq3ukKH7gneRBO7uvx0dDRIqhuuhxbaD:1vXMMmgI1Der2dDRsuhi
- TLSH
  T1B75533A06E9F9DDF4B388F34642F5D0D6E649250C098A8DB7FD468C30A4E780856F97A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5
- Target
  ED Dashboard/lib/em-companion.js
- Size 89KB
- SHA256 54256548bbc7284bb2e341b302a2c4debf5034b36eda66540f64c33ba4ca3f38
- MD5 960e2149d1dd6ccec2928777cb2f36f6
- SHA1 dba9dfcc770fd8209c49eebf2aec3866773328b2
- SHA512 fba20215425947e6a90609955f0e028b2b61546c219f3635585533e8a36f9d98e25fc58ebdcb2125aff9a674eaff9d158441a495c358e85405a4f2a791d38657
- SSDEEP 1536:lvm8vtPAV4t1WgeiMsvakP3gRvLaX5jJBFB6AWN8Z:nFAH3k4RqFGAWNs
- TLSH
  T1A993B6156EF71174AC23DF799BFFA229F26941170412C6287E4C94894F84B7843AEFE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  ED Dashboard/lib/jspdf.umd.min.js
- Size 355KB
- SHA256 98ccf17aa10c20bb1301762618fcc9b6ab3a4e7f26b6071d64d0b41154df3875
- MD5 4b16d1b6023fa7271c62b3dee913c3ca
- SHA1 e53ce4fac9ff70556a53e1a01c8636a33bb48f5d
- SHA512 a99beb992d9e90a3c5da64b39d342cc6a3e09e9908e0335396b754993ceb0e07a4b5cce528d451872e57e4000e9f1e52d3dc9d1585963527dc12a0d34c782d34
- SSDEEP 3072:2j1KrwHaOc78sdqarwMRxm4OwseUjv601L+00ZpD7DFTMftrf6ydO0QLcfouYak7:2MM69Rh6y0TIT6foR
- TLSH
  T1C6743A9632907065429395B0102F010EB23A762A6B8AC45DF776DDD6ECB89DED07BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  ED Dashboard/lib/jszip.min.js
- Size 95KB
- SHA256 acc7e41455a80765b5fd9c7ee1b8078a6d160bbbca455aeae854de65c947d59e
- MD5 b5d02b3f0bf3ae026451909419df07bb
- SHA1 c96375d50e72b199aa54de7b9ad908fd5a2dc7bc
- SHA512 5cc55ddbc175a07fceef57f3c019d5ec7b9c2f1570b717f6e9757c3f8c0f936e840f1b8667dd4df1bb0eb6d9a7a267020f7092e593112f9d07d0680e1ef7a0b6
- SSDEEP 1536:7YwmJxUOuK5LavAojGhgJAVdJRE2z86zTf4W/Ht9Np0P/AK:7OLVjN/X6AK
- TLSH
  T12693179A31A0705553E629E4405F2B4BA1B62626280C406CF738D9DA7DB5DCFF27BF38
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  ED Dashboard/lib/resus-companion.js
- Size 714KB
- SHA256 e8ca74dc62e6b2e9f7f501dbc1ea86d4b88f7957632fb22e5153fa9ab31c8b21
- MD5 568f42194d1d680b51d2864fba902449
- SHA1 4e33dee704d19a09d53f44256bf638494867596c
- SHA512 2d40446d1538a4389847fa90366ddbcdbf9e8cfe513a0830040236554f0418e00711f65c9a39e3b9bc52c761f223ce0bad2c2894ed235716ce6ca2d8a73f637d
- SSDEEP 12288:smHdOcAS7Nygte/kxvpFD8BZRTzJbatsMKIKg:scOcNjtlTu1TzJbatsTO
- TLSH
  T14EF4AEBA29D52E298916E0E4D24BB416ECBD01D38301A4D4784F75FC8FC876C97BF998
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  ED Dashboard/lib/xlsx.full.min.js
- Size 861KB
- SHA256 c9506197caf809a075b6dee1da0d36fb19da7158ffe8a88e7b0c96c5d8623c99
- MD5 31e9848e80e1ddf43c5aa31009cd2b7b
- SHA1 7f749f81a45a53229136c6c1f1d50dcb16ddc233
- SHA512 af6da00a10e71af072964f74fb67bfc9caf7455ac38bc0c83a420636126529fbb240ce2d211008d3ad8c695f2c7e340a6151a338169904e03cef3f8885913d0c
- SSDEEP 12288:nixuiehVjOWjk4TgpontaGx6lPOf6kEUnh1:nVipWjR8potYlmf6Unh1
- TLSH
  T112156DAB368A306E43E169FB50AF2C0328347DA2E44DAC50D241E2515DB6ECE45FFE95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  ED Dashboard/python3.dll
- Size 68KB
- SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
- MD5 962428e9e68d43ecc16f3e33f2ea8667
- SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
- SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
- SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
- TLSH
  T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  ED Dashboard/vcruntime140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH
  T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  ED Dashboard/vcruntime140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH
  T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13