30d8c2fe8785cf4606ef05209eb8163f8f1c5873509406ac0ceb0174ac52ef72

Sharing

Copy URL Twitter E-mail

General

Target
Exodus.rar
Size 176.9MB
Sample260429-c2b93aby5p
SHA256 30d8c2fe8785cf4606ef05209eb8163f8f1c5873509406ac0ceb0174ac52ef72
MD5 f503234efd0fa942ac491f7d3d42572a
SHA1 5e1af5d0fe10972802443b79e24f1de094302ae0
SHA512 6532ed7be099cb974cae9c404286f7558be272cadf51708e133211eaec1f7d0ef8901a6513acaefc776518bdedeb88f1641b9fd010adeb60ab3425999dbdba52
SSDEEP 1572864:XOvc37gElpbRAZlXwaxMczyEePWajAfts/6TN9VnyJ8WNTrMdOjwp5R/Ra380WfB:evc3bbal3MczyELE6J48qPxqoFL+TDt
TLSH
T16498F101B2AE606CD1C7D07C571B8A63B63578954320D9EF319896396FB2FE09B7A331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution pyinstaller

Malware Config

Targets

- Target
  exodus/Exodus Installer.exe
- Size 12.9MB
- SHA256 a39d22f3fbc421189033a66718618a288f2e89bca13dcb169bb8a8515eac79af
- MD5 ea5ba5b8ba8a3a03ee993bcbbd0422c3
- SHA1 ddf15149814c18730aff409499d46e0d4a744caf
- SHA512 d6da81b911747ced7c67293bc45cf35243d66c3bfd708ef39dc40b86c1bcf1d01f6e4fe27af89ca5e7232bc3f612210b993766a54e8c2c148fc8719056eb0103
- SSDEEP 393216:3CrN5ox/hEVbdXQfM6R4RmhjHsnvDwHjBAM:SrXoxYYMc37gEHF
- TLSH
  T12BD623276FB5CD98C158BD3A69F18327F3718E250F9645132E111F636A73DA8EF22284
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Loads dropped DLL
behavioral1 behavioral2
- Target
  exodus/cs/Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
- Size 15KB
- SHA256 252742341b4cd14ac19604d4274d4db2657f052b366a24c0eb41470e7ccd4814
- MD5 08a3c9d07299343b8a7e18db0e5ea672
- SHA1 5ac352a7c0922fc663f2befaecfe8012716aa77e
- SHA512 9b7643cc8db5ebb746b8eeb9d2381e61ac63c86ad7f731415dc0fc375ceaaeb18d4a4f598a345612d73987f58f9eb12f2d6f9f8fc278f3027ed3b7160c65661b
- SSDEEP 192:1bM1hT7RwYDqaLJHWkGOqIJ+WG0cW4GD5dHnhWgN7aQWS28qOQophFKqnajKsaYW:hM1hiY7RWkBfQWPfdHRN7K8qJXlGsaY
- TLSH
  T14D6219919BB89903FD762D715674D543BF3EA386A810821E385EF6490F637C1EB20A39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  exodus/cs/Microsoft.CodeAnalysis.CSharp.resources.dll
- Size 336KB
- SHA256 3600cc8a8d83522baa10f07fc7027d3cf64ef03b644a35db920d248bbaccd30e
- MD5 98f732a2a542ac4d97392b7e42709131
- SHA1 1d51dbd93a2ca77892c0bb7727e5e0e8c4818141
- SHA512 9abe2648f22b5b3286bbd7ddad09a7799d8b53560a4c601d223987dceb2c0a78c93537b28297999b03849294669edd1c0e2e0a3d0677280b671f5974b285d1c9
- SSDEEP 6144:WUYIvaPzbGnxQQkdyfGZGG9lohQxTj4D:W4JGZw+S
- TLSH
  T16B74951177E55008F6F70BD87BBAD628D93E3EA91A14C6AE244D074F03B5A96CE70732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  exodus/cs/Microsoft.CodeAnalysis.Scripting.resources.dll
- Size 16KB
- SHA256 2485fe3dd4c8c74d581f2e024a6d6d99b07e25019102af1ade3a7bb916a16c9d
- MD5 fad51118423dbd0b7668d9f856f64191
- SHA1 a1ec78b56d2c767a14242bf7fb2cd2bcbdc1fedb
- SHA512 4a6b3a3477031c273b2305ea9c6ddf9e192af3a35c68fca9becbdf5b7b0848a041acfefa5df2769f930c7508c017f8ee4f4ca372f5f38fdce210c321f15c7e21
- SSDEEP 384:ERwiFPY/V8nFAL3LkWPiweWgZdHRN75WoiFWSlGsQi:EiZ/lbbgvDHP
- TLSH
  T12372288097FC810BF8B72E71ABB4D5832D3E67926822916F254DE5491E637C1CF21A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  exodus/cs/Microsoft.CodeAnalysis.resources.dll
- Size 37KB
- SHA256 3f01d8bd84718f05e6cfcf1396f11b91b11fa93e5e9b07b2236e0d1e7e8c16d5
- MD5 e98e218b28c34b4c863c23b99c0419cb
- SHA1 d8b99eabac530633da21c6601c50aeac02712540
- SHA512 6c64a424c6b4a5c792570211c914017610575dd29742d4bbee786211bd335677611e26e5f9102c2e14f1678d67370657688e4423e22cac4e8fb1d3d6361df6ce
- SSDEEP 384:QAcSO/W8hAuh6t1Onb9U6LIMbJBkWiZDyjdn1rfUWKgYO24N4WPXh26HoEtiWVlZ:QjSMW6N+EvveW1wWPXT9B+/ozr
- TLSH
  T1CA03C350A7F8650AF6F72F747BB88A45593F7FA62D21D4AD0409868E0972F80CE70736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  exodus/de/Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
- Size 15KB
- SHA256 1fcb3bae1ae22df51b857d3b1d31b7582fb18d5f1c6870cb77c41a05a1be3f6d
- MD5 cbef52b59578e2959d25c8c2a377ced3
- SHA1 a597c7f7090c9aaada391f0fcac8f300669dac60
- SHA512 99f0d950e5f7aca03ab088fb87b6765bbbdedf3a0530bdc50c4e2056d66e7080fc7dd42eb775072513ba231880b6257e11aa3db05ed7b2e18c5e6edbb4919214
- SSDEEP 384:4rPIB0WkBfQWPddHRN7twuAzXulGswDuSt:YPIIRbwzrz
- TLSH
  T1F3723A929BBC8503EDB32EB14670E5437F3CA396A920936A344DE6590F537C1DB24A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  exodus/de/Microsoft.CodeAnalysis.CSharp.resources.dll
- Size 357KB
- SHA256 fc94348bd9eef983e6b7f409c648e8a79c8c8f58a04ad21d61a04658a9b10283
- MD5 3032be8d7a93e8b07d035fb1a1982269
- SHA1 28afc0d85d14df2d50bb15849ff9ef944ca63409
- SHA512 80b67e0f944f2b3c369325c86a662f40c12893ec8673c266fa5c7bc9149cd738cb3ea13c26eb24df298e7302fb6b82567cb6012a3b5d66fbb93baf970fecf6c9
- SSDEEP 6144:NuDkE1KB8s1Sszx4kHqxQvRc6kAB4Xb9MHx4ircACQ:NU613vRc5AB4XRMH6acxQ
- TLSH
  T1A87477017FEA601CF2F75B943F75D95AFE3AB9E61A41C21D105C812F07A5EA28938732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  exodus/de/Microsoft.CodeAnalysis.Scripting.resources.dll
- Size 16KB
- SHA256 fc8ef2d18b0c4a4e7e3b5902b940a84db7b59857dc92445096608901253aa0c4
- MD5 29f6614779d0647ebae9cc0c01569a63
- SHA1 270bfcaac7a24cc4a60d8bfef85a6d0a38d44b0e
- SHA512 ddb1a0e40107c47cb1802fe8f3c9df4dd161bc520eb5b4200467c1ef2f9cf9040ea37fe689332436c55f0925f75846b75403ffb6a33a95fe7d517e00946461b5
- SSDEEP 384:dqoJxFK6AK2rDT/WPiweWgOdHRN7vJXlGsxZi:dBtAfDTOg0xEX
- TLSH
  T1E07229818BEC5107F8B73E71AB75D8933C3DB7966911D21F204AE25A0D637C1DB24A39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  exodus/de/Microsoft.CodeAnalysis.resources.dll
- Size 39KB
- SHA256 857557629e43a1bec79d3be2a3e7ab5c7a7cf6fec58ba38d5c0f389733ed3f73
- MD5 fb4512a9bb4596d3e400cdeb19b9159e
- SHA1 87d8ab364e7dec55c782d5285edde075311d78a2
- SHA512 b80e019b4c1b59486534171706ef8d3db707fd220a4f06881a8f03ea29d309dbe6c022f22538eb057129ec4e6e2f2bd7b97178d974814ba1b35be2e47afe17e8
- SSDEEP 384:bcSO/VdGnmoro/1PbJRYtXMmu21YaxcaApFz0KgxcvdFPh3BAWcHAla1vD/S1g1S:gSMVd2899+qKK0K5tRxa1Na+r2mC5Qc
- TLSH
  T122039341ABF96109F6F71F707F78D896AD7ABEA32E50D01D0044805F0A62BA1CE74736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  exodus/es/Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
- Size 15KB
- SHA256 239a1ee38b3ca184ffe28aa914cb64baa1096b3a634fdcbfc057ed2f82e427cd
- MD5 9f0e12f8d076977f57205347dee6f859
- SHA1 fafcbafddac802d61ae0cc51d74f21c141aa0ed7
- SHA512 f6d500d801f50b8c0127f0d8689f8c36d7582e6e7f7e1e68d4bfe32d966bc5bb523037c6b7777d6a00c25ac0ab2225d7079034a8044e9dccd9664cdf0716a814
- SSDEEP 192:VbM1IDndLN9sTWkGOqIJ+WG0h8W4GD5dHnhWgN7aQW9MpD7DiqnajKsn/nQ:BM1IlsTWkBfQWPh/dHRN7oMpGlGsnPQ
- TLSH
  T103722A518BA85203FDB3297141A4E543BE3DA3C6A821C22F399EE7581B577C5DF20A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  exodus/es/Microsoft.CodeAnalysis.CSharp.resources.dll
- Size 350KB
- SHA256 06d017755b460781295f8a81329c2c2b6ecd0914fbdbc042705e28f2f0ced2cd
- MD5 91dff720f12ca2ba9f04773af3d85107
- SHA1 b6d469dd501be7f442890ccd435578f39b667ea8
- SHA512 8231a509ff31f9af3818c52f5f901443a19d95f1d15c12bcba6b7913a15c34d57c9af35b623e49252f6b36d75746f49af5f1cdb8f23aeede4c224b5d2a7ad6fb
- SSDEEP 6144:P5vk5O5fWue42zV1UolAWgT+vE1Q++gj0dufFKl5Z:PS2FY
- TLSH
  T19674732667D91644F1F317987BB7D64BEA767CA53900C29E601D431F03E8E88CA66F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  exodus/es/Microsoft.CodeAnalysis.Scripting.resources.dll
- Size 16KB
- SHA256 81d829061f8390c6e51fdf0bc6ca8e24fbf106c0580c74bec44c442338941aa5
- MD5 af8f0f9316a82030d635c7c458bb84e4
- SHA1 cb5f7f3d6ce7ff599a6b6912987db10c666b4c26
- SHA512 3e31bde30d0dfcb772c395512b684ec25242fa65cd8434df1e8a4e1521b9b17614a0158973453a0b700e9ade7a2a55bf66295df90c86dc365c6304e684c5df04
- SSDEEP 384:nq9IF+AYcmsWZMWPiweWgYdHRN7TLXBGlGsns:nMCY7sWZjg2TLh
- TLSH
  T12A721A518BE84506F9F32A70AB79EA437D39BB922810D11F154AE3590AA77C4DF30E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  exodus/es/Microsoft.CodeAnalysis.resources.dll
- Size 38KB
- SHA256 4e8a7c2bc4b093990887def61f02c60347aeb4f7a159fb4d7c9049815d6b98cb
- MD5 26633fada1fab252af074c18ef3177ce
- SHA1 064dd533caeb730c6b25ca927aae4f2edf52c288
- SHA512 b3e7712325c19692e35fced68a1123b56da9ed1a99e7610ed63b023d1cccb17e7c197197a19190bb16cf72af57afc360f1046d25878468645e63dce553cd7c98
- SSDEEP 768:sSMJQZ426XL/2pOCoYSi8POj2+H6i+pol:hp6Xj2sCyi8Gj2+H6i+pU
- TLSH
  T1ED03C551ABE82606F9F31B30BB76D6979D7A7DA63C10C19E0019824E15B6F84CE70B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  exodus/fr/Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
- Size 15KB
- SHA256 f212d44b5aaceb9cc594996606f3ca83fd29542f8b6463a82987d9e7a58416ad
- MD5 68ed261ccd040048ac71597a5d9bcc1e
- SHA1 f256e2f8e24c3ae7a45beb4dc1f79ea6e2206dd9
- SHA512 554fe99ce738bd5d61b31b54bc207c91afa8cea34cf57157fdd2a32f443c7cf2fab75ee40beb3c3d89b3523748d4c1df4b0c24797679649d4eac00b66f7dd90f
- SSDEEP 192:aho9Yt9n9DAnsWWkGOqIJ+WG0SW4GD5dHnhWgN7aQWGVD7DiqnajKsnZl7:Mo9YtRCBWkBfQWPBdHRN7jVGlGsnZl
- TLSH
  T181621A869BBC8543F9B629715A64E943BF3DA3C76411821B385EE6480B937C1DB20A3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  exodus/fr/Microsoft.CodeAnalysis.CSharp.resources.dll
- Size 358KB
- SHA256 b02dd6d4933a475e2d62940e1184158d4a38c9e51139682a9746c369d73618a3
- MD5 63b3ed8d3e257e69a0dd3c4638d073a4
- SHA1 9527dfa23166edc459407ae3c4447057d4f83201
- SHA512 41cbfb313fab1f7d9c2d5b39a2fd8074b1ff414dc8776c7b4e79fc7a52e59a5c90ae6480483cf74416163b4a09024dfe50294b469e964e58772ca92fff25631b
- SSDEEP 6144:0bHHeqrjpJBSBi+CPYz7bivWVcncwfKadC/MVKb+LEvVbC1ZHl8oVmjMZjjmGG/S:0VpQz7bivWVcncwfKadkMVKb+LEvVbCt
- TLSH
  T10F74A20AA3E82049F1F31BE97BB7D20AC936FC952701C65D648C465F03E5AD5C726BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  exodus/fr/Microsoft.CodeAnalysis.Scripting.resources.dll
- Size 16KB
- SHA256 2914352ed35a4a7911649643f4c0ffa3cf920bb422b4c021dd0c2793b86d1f40
- MD5 09cdd8a273346a0739ee690c6cb65c0b
- SHA1 062278d31733d34b6b96d9859913e8c70aed45e7
- SHA512 e485fd3d9a594b387b6460412f32aa7dc4da76b9dc07b78536a0811b118e2c382eb90dfbd644b801d11922738c8f89dd78fbed7b6ea2a1b7ed735a494c0eb561
- SSDEEP 384:Jil+EFMgvnLxN1hWPiweWg5dHRN7Kt0uw7lGsp:JigcnVMgPKuC
- TLSH
  T14A722851CBE84643F9B72DB1AB75E5437C3CBBD62810D21E544AE6492A937C0CF20A39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32