home

alexserv_install.exe

The file alexserv_install.exe has been detected as malware by 2 anti-virus scanners. The file has been seen being downloaded from cpistore.internal.ericsson.com.
MD5:
7e02ded49b629d749d6f2d47fb20541b

SHA-1:
39aba0e5b7a12be33f66b2c1c679eccb7f84e544

SHA-256:
5f5ba4cd74acedfc6f568f43cec6c4c6dd949416d917819d01f35a22229b617c

Scanner detections:
2 / 68

Status:
Malware

Analysis date:
1/5/2025 9:40:44 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
W32/Sality.AT
7.11.30.172

ESET NOD32
Detection.Undefined
7.0.302.0

File size:
4.5 MB (4,705,609 bytes)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\alexserv_install.exe.n7avdu3.partial

File PE Metadata
Compilation timestamp:
5/5/2015 1:38:21 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:HNNq+wt32nAKgDWU3W57OpGF70punETvzVjmQc8PQzt1muuMPGDYI5536ekC:HNDwteKWUm57YGF7Xn6vVmx8P6QqPG0C

Entry address:
0x6A43

Entry point:
E8, B7, 37, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 56, 8B, 75, 0C, 56, E8, D1, 43, 00, 00, 89, 45, 0C, 8B, 46, 0C, 59, A8, 82, 75, 17, E8, 73, 0F, 00, 00, C7, 00, 09, 00, 00, 00, 83, 4E, 0C, 20, 83, C8, FF, E9, 2F, 01, 00, 00, A8, 40, 74, 0D, E8, 58, 0F, 00, 00, C7, 00, 22, 00, 00, 00, EB, E3, 53, 33, DB, A8, 01, 74, 16, 89, 5E, 04, A8, 10, 0F, 84, 87, 00, 00, 00, 8B, 4E, 08, 83, E0, FE, 89, 0E, 89, 46, 0C, 8B, 46, 0C, 83, E0, EF, 83, C8, 02, 89, 46, 0C, 89, 5E, 04, 89, 5D, FC, A9, 0C, 01, 00...
 
[+]

Entropy:
7.7015  (probably packed)

Code size:
49 KB (50,176 bytes)

The file alexserv_install.exe has been seen being distributed by the following URL.

http://cpistore.internal.ericsson.com/download_server/dlserver.php?type=dl&filesize=4705608&DB=2087&ID=2087&BT=5&DBN=47624-cnah118010_4r17_1.zsw&FN=alexserv_install.exe&PKGNAME=/data/libraries/alex_libraries/CPI/TOOLS/.../47624-cnah118010_4r17_1.zsw&confirm=yes&downloadDisabled1=no

Remove alexserv_install.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.