General

  • Target

    Fake Exodus.zip

  • Size

    64.1MB

  • Sample

    250113-v64h8atkaj

  • MD5

    b07022b51057e5400b93f90da9dbee96

  • SHA1

    14192724f78b0aff9d06fd0f6994e98bd5e2b851

  • SHA256

    a058ba972382482df87b97f8a2bbe2d0179231c1d24e9ebb86bbc144a0546e7d

  • SHA512

    713bd45e3f3a4bf24ceb1936eab2ac7bc495064b2bc122764f47da13959bf9f8a9b5288086507b769be32fb6d80c7a58876a6d55ad1fa24a7202ddc62b67e819

  • SSDEEP

    1572864:O+o6npjQKxDP53fqSNfAUqqb6J3zM7SO8qynHo0j4za7KA:O+o6nTSUbvp8tnIVa7h

Malware Config

Targets

    • Target

      Fake Exodus.zip

    • Size

      64.1MB

    • MD5

      b07022b51057e5400b93f90da9dbee96

    • SHA1

      14192724f78b0aff9d06fd0f6994e98bd5e2b851

    • SHA256

      a058ba972382482df87b97f8a2bbe2d0179231c1d24e9ebb86bbc144a0546e7d

    • SHA512

      713bd45e3f3a4bf24ceb1936eab2ac7bc495064b2bc122764f47da13959bf9f8a9b5288086507b769be32fb6d80c7a58876a6d55ad1fa24a7202ddc62b67e819

    • SSDEEP

      1572864:O+o6npjQKxDP53fqSNfAUqqb6J3zM7SO8qynHo0j4za7KA:O+o6nTSUbvp8tnIVa7h

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    • Exelastealer family

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks