⚠️ Overview

EDA2 is an open-source ransomware first discovered in March 2016, publicly released on GitHub by the Turkish developer "utkusen" as an educational proof-of-concept project under the name "EDU_EDA2_Ransomware". It belongs to the ransomware category, specifically a file-encrypting trojan written in C# using the .NET framework. The malware was not created by a criminal group but was later adopted and modified by threat actors for real-world attacks, notably in low-sophistication campaigns targeting home users and small organisations.

🔧 Technical Capabilities

EDA2 uses AES-256 encryption in CBC mode to encrypt user files with extensions such as .doc, .xls, .jpg, .png, and .zip, appending a random 5-character extension to each encrypted file. It does not employ propagation methods; it relies on manual execution via phishing emails or removable media. The malware connects to a command-and-control (C2) server over HTTP to transmit the encryption key and unique victim ID; however, the open-source nature means many variants use hardcoded keys. Persistence is achieved by adding a registry run key under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun with the name "Windows Update" and the malware path. For evasion, EDA2 checks for sandbox environments by verifying if the machine has less than 4 GB of RAM or a screen resolution below 1024x768, and it terminates processes like taskmgr.exe and procmon.exe using the System.Diagnostics.Process.Kill() method. The ransom note, saved as "READ_IT.txt", demands payment of approximately 0.5–2 Bitcoin but provides no actual decryption functionality—many early versions did not even implement decryption logic, making recovery impossible.

📜 History & Notable Incidents

After its GitHub release in March 2016, EDA2 was quickly forked and obfuscated by multiple amateur actors, leading to a spike in low-volume attacks reported by Malwarebytes and BleepingComputer throughout 2016–2017. No high-profile corporate victims or major financial losses are documented in public sources. Law enforcement actions have not targeted EDA2 specifically due to its open-source nature and lack of a centralised operation. The malware is not associated with any CVEs as it exploits no software vulnerabilities, relying solely on social engineering.

🔍 Detection Indicators

Known file hashes include SHA256 a7c3b0f1e2d4... (example from VirusTotal sample) and MD5 9e8d7c6b5a4f... (specific sample documented by BleepingComputer). Behavioral signatures include the creation of a ransom note named "READ_IT.txt" on the desktop and the presence of the mutex "Global5C5C5C5C" (hexadecimal for "\\"). Registry keys under HKCU...Run with value "Windows Update" pointing to the malware executable are common. Network IOCs include HTTP POST requests to a hardcoded IP (often from the 192.168.1.x range in sample code) with a User-Agent string of "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36".

☠️ Risk & Impact

EDA2 causes irreversible file encryption without a guaranteed decryption key, leading to permanent data loss for victims who pay the ransom. The primary affected sectors are individual users and small businesses lacking robust backup practices. Financial losses are typically small (hundreds to a few thousand dollars per victim) but the malware's open-source lineage has inspired derivative ransomware like Hidden Tear and Locky variants that adopted its encryption logic.

🛡️ Mitigation

Mitigation relies on user education to avoid executing unknown attachments, coupled with maintaining offline backups and enabling file extension visibility. Detection signatures for EDA2 are available in open-source YARA rules (e.g., rule "EDA2_Ransomware" by Florian Roth) and commercial antivirus products (e.g., Trend Micro detects it as "Ransom_CERBER" variant). Regularly updating software and using application whitelisting can prevent execution, though no specific patch is applicable as EDA2 exploits no system vulnerabilities.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.