Overview

overview

7

Static

static

3

exodus.7z

windows10-2004-x64

7

exodus.7z

windows11-21h2-x64

1

Resubmissions

20/04/2026, 21:39

260420-1h43qsgt9w3

20/04/2026, 21:35

260420-1fafcaes4k7

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/04/2026, 21:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    exodus.7z
  • Size 36.6MB
  • Sample260420-1fafcaes4k
  • SHA256 a263d508f742a922fb63b7750eb943f144cec5b7709586b4d16dcad556e618d2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\exodus.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2444
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1072
    • C:\Users\Admin\Desktop\exodus\Exodus.exe
      "C:\Users\Admin\Desktop\exodus\Exodus.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      PID:1504
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x3cc 0x2ec
      1⤵
        PID:560

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Avalonia.Base.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Base.dll
            • Size 1.7MB
            • SHA256 8f0a12e7134d617f0bdcb0167479dd0c17de4bce192fc779b5673424470aa2cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Controls.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Controls.dll
            • Size 945KB
            • SHA256 96b2fe74060a3727fc88c4f134516c1b6bd6539a111ab80585df4fa3e45c6bec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Desktop.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Desktop.dll
            • Size 15KB
            • SHA256 d9b6df687c86a43d6b8ee385f27856da281e08338be3b05057fc134de4be6c6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Diagnostics.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Diagnostics.dll
            • Size 302KB
            • SHA256 65014f100c8c25363bfd20c47018a3c2b5eae10daf51e384480abff8ecf061f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Dialogs.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Dialogs.dll
            • Size 228KB
            • SHA256 62485d2fec62151f1c3771196916d1336704437e4234a02d944d72058c6a0250
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Fonts.Inter.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Fonts.Inter.dll
            • Size 2.4MB
            • SHA256 ac72898b6ceb35ae50ccb816af6e7ec32defc6667725b624507555fc81dfcae4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Markup.Xaml.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Markup.Xaml.dll
            • Size 75KB
            • SHA256 86a3eeaa9b507e71fd91398add6c1bcb2e424d65da3221ce943ca637d771c510
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Markup.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Markup.dll
            • Size 66KB
            • SHA256 032576788b40e65f94f908d2a9f26a62c1b80b7b133e2bd97f31571262f93c8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Metal.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Metal.dll
            • Size 14KB
            • SHA256 11842f337b791d7d181d386f8be63e4f7fc8dc4d0c012426b190011b5228e45b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.MicroCom.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.MicroCom.dll
            • Size 15KB
            • SHA256 1cfbb23f757a19afcae54e9758050f2bf8b101b31b78c9effdb53e2a7dcb526d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.OpenGL.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.OpenGL.dll
            • Size 93KB
            • SHA256 4bc9c53d8b224322bb0315af3da45fb68f6654f45cc2a963422917cdb2301fa7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.ReactiveUI.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.ReactiveUI.dll
            • Size 35KB
            • SHA256 a88c3dc9149a5a0a5c86ade48108c06c7e144b7716227d48ca82fdcb528509be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Skia.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Skia.dll
            • Size 105KB
            • SHA256 d4ed40ae7191470d1711c765e8d9dab70cfdc6c3d4da48b941135cbf8762b8d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Themes.Fluent.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Themes.Fluent.dll
            • Size 750KB
            • SHA256 59240a98e5bcaf365faa40bd8e4897a3a06180fa531047283a06dda474a838b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Avalonia.Win32.dll
            • Path C:\Users\Admin\Desktop\exodus\Avalonia.Win32.dll
            • Size 632KB
            • SHA256 f7b8ef7fd57c4393d1828aaecda24c2dce8af7066c76f3a8aba3703c6ddbe718
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CompositionScroll.dll
            • Path C:\Users\Admin\Desktop\exodus\CompositionScroll.dll
            • Size 56KB
            • SHA256 b29af891dd11ddd10524f9aa80c232b5f75a202f94a1396d533a1ad1fd4e5d0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DynamicData.dll
            • Path C:\Users\Admin\Desktop\exodus\DynamicData.dll
            • Size 723KB
            • SHA256 321f1d2a049323100db943f4664bf5a891af8040bae14a0e724f420ac2f530bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Exodus.deps.json
            • Path C:\Users\Admin\Desktop\exodus\Exodus.deps.json
            • Size 56KB
            • SHA256 92f071729f2fbacc705761777f28e23090beafda0c5d6807cff238c393ab527f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Exodus.dll
            • Path C:\Users\Admin\Desktop\exodus\Exodus.dll
            • Size 4.0MB
            • SHA256 329b8945fb885973c8e0e2caacd01521e98cd6a479b3cf495b88fb35e28cd96d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Exodus.exe
            • Path C:\Users\Admin\Desktop\exodus\Exodus.exe
            • Size 507KB
            • SHA256 849c0420722c1dabb927ff0ab70375bc1197ba73a7f04885460b609392bd319c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Exodus.runtimeconfig.json
            • Path C:\Users\Admin\Desktop\exodus\Exodus.runtimeconfig.json
            • Size 463B
            • SHA256 ac0c6de2ad16f573d80324fb57cdab1d7bccd8b61b0bc4ef73a09bf89c0badef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            HarfBuzzSharp.dll
            • Path C:\Users\Admin\Desktop\exodus\HarfBuzzSharp.dll
            • Size 114KB
            • SHA256 43865d1aafa39c8b8fba7d95a09f9c3ec07b87d8cd86b1b1eabe331649d271af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MicroCom.Runtime.dll
            • Path C:\Users\Admin\Desktop\exodus\MicroCom.Runtime.dll
            • Size 14KB
            • SHA256 59839e18e46b06ab23b633944ae3c3b552a300c5da389da870dfa980bcef93c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Newtonsoft.Json.dll
            • Path C:\Users\Admin\Desktop\exodus\Newtonsoft.Json.dll
            • Size 695KB
            • SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ReactiveUI.Fody.Helpers.dll
            • Path C:\Users\Admin\Desktop\exodus\ReactiveUI.Fody.Helpers.dll
            • Size 27KB
            • SHA256 184bb1a17a1f30c38bd039ff776c3c6fe7a3f680a2b30d8785d3ff90e5fbd14e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ReactiveUI.dll
            • Path C:\Users\Admin\Desktop\exodus\ReactiveUI.dll
            • Size 295KB
            • SHA256 620b8aeb14cdd6143d3fcb5273af510cd898e50b08b6dd717ba124eb64e77bb5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SkiaSharp.dll
            • Path C:\Users\Admin\Desktop\exodus\SkiaSharp.dll
            • Size 422KB
            • SHA256 6c38973434c742d65a0e2b82c6f5471e53ea1d85fb0ca058274ecd4f7d51b839
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Splat.dll
            • Path C:\Users\Admin\Desktop\exodus\Splat.dll
            • Size 137KB
            • SHA256 626e82d8797eae368dc11347df2425d3f9860fca8ba52df741139895dffa92a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Reactive.dll
            • Path C:\Users\Admin\Desktop\exodus\System.Reactive.dll
            • Size 1.4MB
            • SHA256 2b6c31dfb1fc6019a42a007ed0e5e00574de6ea0c47fed0ca282bf3bb2771b0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            av_libGLESv2.dll
            • Path C:\Users\Admin\Desktop\exodus\runtimes\win-x64\native\av_libGLESv2.dll
            • Size 4.2MB
            • SHA256 85b3aee47c0e0eaf3a5ea5c75ba8131387a12639b6a0ef280c28531fb77695ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libHarfBuzzSharp.DLL
            • Path C:\Users\Admin\Desktop\exodus\runtimes\win-x64\native\libHarfBuzzSharp.DLL
            • Size 1.5MB
            • SHA256 f13d0dae00a598620a436fd991219a2e0fe6157eac90faa025d4d76845cd996c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libSkiaSharp.dll
            • Path C:\Users\Admin\Desktop\exodus\runtimes\win-x64\native\libSkiaSharp.dll
            • Size 9.0MB
            • SHA256 3268b1b2de384d00ed77431fe8a1f053d2c69eee25d07dcfc352491570d63b52
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1504-509-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-511-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-513-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-514-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-515-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-516-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-517-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-518-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-520-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download

            memory/1504-522-0x000001DD35D20000-0x000001DD36075000-memory.dmp
            Download