985127ccfe57d8926de6d95a97d3f4b0d17ad353e6e8f8826c151569982b2b49

Sharing

Copy URL Twitter E-mail

General

Target
Exodus (32).rar
Size 1.1MB
Sample260604-3f1nmsht7j
SHA256 985127ccfe57d8926de6d95a97d3f4b0d17ad353e6e8f8826c151569982b2b49
MD5 ded782e659af95f943b9a6c1f66dc72d
SHA1 602f44f8642030a413704f5befe6775a58f29b02
SHA512 bd1e3a77307a3e1ef760d1ccd9cdb7804f72c5f3780a2196c471ecfed4e31c21fb872ea666610244c3542a9b9a2ab5772a0ad971da7e9c811d0105e31b39b171
SSDEEP 24576:wM9pS2HTedqqpDqp31dmdOWV15SOCkdcj7lhYu44ZzsLjjICy:wYpS2HSdqqM+dnSOCk+jfYeZgIz
TLSH
T17F4533E982933CB4AF485B82DD536C7E0E818B421A445EB533F8FB151A7F5694A7F0C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Exodus (32).rar
- Size 1.1MB
- SHA256 985127ccfe57d8926de6d95a97d3f4b0d17ad353e6e8f8826c151569982b2b49
- MD5 ded782e659af95f943b9a6c1f66dc72d
- SHA1 602f44f8642030a413704f5befe6775a58f29b02
- SHA512 bd1e3a77307a3e1ef760d1ccd9cdb7804f72c5f3780a2196c471ecfed4e31c21fb872ea666610244c3542a9b9a2ab5772a0ad971da7e9c811d0105e31b39b171
- SSDEEP 24576:wM9pS2HTedqqpDqp31dmdOWV15SOCkdcj7lhYu44ZzsLjjICy:wYpS2HSdqqM+dnSOCk+jfYeZgIz
- TLSH
  T17F4533E982933CB4AF485B82DD536C7E0E818B421A445EB533F8FB151A7F5694A7F0C8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery ransomware spyware stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  Exodus/announcements.json
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
Score

3^/10
behavioral3 behavioral4
- Target
  Exodus/exodus.conf.json
- Size 1KB
- SHA256 c591aaad4f77111883ea72f676a7886a65849e0bf7ced7458a112378224ddddd
- MD5 57fbe004188b47f61fadae34c4c60c5f
- SHA1 b735ff186ac154346e62ad9bd8eaf35b6295041c
- SHA512 9cb88bb3450ba2e145e15c60f926898740cf82f228c339cee8780ae8ed214be84e960b539ce751843f545d53c1ca4a4a0b8fd3da419799f532a8f1bfa4ff7fcf
- TLSH
  T11041E228D5B41CB306D6B1BA8C7F2103B57085AB4D1C3C383A9D665C5F0DA3D25AABF6
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  Exodus/exodus.wallet/info.seco
- Size 32KB
- SHA256 c99a836641747c595f823613f54d27e27362d0901d45425444cbfac6779b793e
- MD5 c0540b42b07874653eff2957d87c6c9c
- SHA1 059f244437fa024f0a14464df05fe6e1f6084c2a
- SHA512 6af5e6a459c50f1014f47ad898a33ad03d46d3829fd5e95b9eb428a1820f010812a8aacc764f66a134413d7b1b264bdce224effb6bee4eb5eb6baf9b7d13cf99
- SSDEEP 768:M+srSBL3B5ofiUHY5lNVkpKRu4bZOKbKp4n5dwBb:M+59eRY1VNbpKp45dwB
- TLSH
  T1D7E2E15F930CBD55CC8DE5F39C7410B1251BBE67F22A1CADB42881CCA6BD2E221DE1A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral7 behavioral8
- Target
  Exodus/exodus.wallet/passphrase.json
- Size 85B
- SHA256 98f255d1fde15e2458e2c45db13cf1ae8c4350cf39eacf48a6230dddcdd2d902
- MD5 0a163c3429ed25026450867690f3a29a
- SHA1 c527d00547ee71fde5219ae0f898d694990db62e
- SHA512 cc6b24177f53e2da4f2e343ec7fbe6ee0fa33840c9743464b1b4d6ae548c7ecc8d59337cdfd5799b4ddf9b303e8c7fd2954044cc13f8b2f4e2f9bf229cdc100f
- TLSH
  T19DA012D501480E2ED0E29502C0011046C425EC87012648218891610566BC90301B1221
- MD5 SHA1 SHA512 TLSH
Score

7^/10

credential_access stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral10 behavioral9
- Target
  Exodus/exodus.wallet/seed.seco
- Size 32KB
- SHA256 4bc4156ce0af0cc7b73dbae22cac24a9e94df66b15c7717a14019fce78a30ee6
- MD5 f96afed268dbffa7686fcb534f4fbeba
- SHA1 67d518b87b0364a03c32bf23064998692ba027a6
- SHA512 4796e38fae70cf1ad370a1412d3277b3efc1da6d1c5ec7b759db51339dce782e3c064b467a8cd8515ec3c6583ac5f22d0f4669eec6b6c0ffd424dd7c058410f0
- SSDEEP 768:HLQre7sdvN5gfecD87kULC8c03aC30DKi3IdDXZ+p59F3wBcP:rgFNyfG7RtaNKi3I1sp5HbP
- TLSH
  T130E2F1A62D5E4C2ED7AB04714D887AC7F0AAB952AF12831595223E0E3138FD7F442138
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral11 behavioral12
- Target
  Exodus/exodus.wallet/storage.seco
- Size 538B
- SHA256 53367e8e1831bd3b7930afdb4407df43fcc392ae910cfff4cf2352baf37291e8
- MD5 df17847124625dc5f100df5907eb5e6a
- SHA1 47ad9bcfb1073266dcdf79022c6b20fc708e3f4b
- SHA512 9a04233724e98c2fbd6a6c7d7a7f78e009c0750f9cb49f314e2676b25b91e3191f8f081ab5b0d541fc38997b8257da01b42a250af29e60a6a2e77ea9a951fabd
- TLSH
  T167F0957BFEE064ADD3115C7214139116014521139F615E0318504F6D0151F14B55C0F7
- MD5 SHA1 SHA512 TLSH
Score

7^/10

credential_access stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral13 behavioral14
- Target
  Exodus/exodus.wallet/twofactor-secret.seco
- Size 32KB
- SHA256 e67a6da2e0130209640d123625797f3498678ca7614fd19d381cd896f810e30b
- MD5 cf259d1862598e2c5b2b55a2992c9db1
- SHA1 6de1e286a297aab43dbeeec9e7f771f7328a6e01
- SHA512 3499bf17a0e0a136ed2489e4561a9833270d255109f306a1884160a5465a659762192f31b83eb7465ba7582ba619eabd53488c1be6af57706d0a992b505a54e6
- SSDEEP 768:e/PuFEhfaJYhbGID9+Kt3wj2jNXBavV0xijQU+He/6YyfbT5:bFEhiQ1D9+swKtBattQU+He/Eb1
- TLSH
  T1C8E2F297BB5C4F41CE41217AE2E760B6B9CD72A9541D6B0DE2363D2E487C3D8A2DC503
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral15 behavioral16
- Target
  Exodus/exodus.wallet/twofactor.seco
- Size 32KB
- SHA256 5b3b7c727e6ccd6198f45f5cb229cb8489a3e514d0f10b502c526a4767c8de54
- MD5 aab35cb078f3282698f1fdb64be0dcda
- SHA1 87e26118c717d1a30b85f12f4a791a868cf5b48c
- SHA512 ed6ad80aa5defd20c9706cd70cda206732b15f5fed355693b77083362e5a9af01a368ccae41e3d2a527edea013bf193898a718fc206990713b30e9053e57a244
- SSDEEP 768:37GLNjEx0YIy0oF3VuKR7Upilm0a6iYkpYA0LbxEU1:rGx4xIyprj7cilm0qBpz0n
- TLSH
  T15BE2E18EADB7E829DAAB9AF73B559030D2F8D55C15933B0134A33629CE785F6404F183
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral17 behavioral18
- Target
  Exodus/market-history-cache.json
- Size 4.5MB
- SHA256 54af3ccb34d06ba8ffa9e6b7e3cd7963aefae6fead27b21d615959137e4078ca
- MD5 7ea16aacd9ef950d4f39e7d2bb99baf6
- SHA1 10409124f1f453a50878414e34732723fd860776
- SHA512 4fb7eb454ccaceb385bee3da0525ec9b1e7313e1e719c99ddace4768d30d55cb0d5e1d4b1d95be3e59c38d1021bfbcf9786ec048cc1a0ad1b74903cfb5fbb875
- SSDEEP 1536:YnE7pyGBpfBpiSbFKHRGnZAAn9iyo9/bnZFZPpoeo9oDoVfu4qh/w4ZCecxvzwlM:B/oPbgficl/k5S5ffQe9asT4/q8fUYE7
- TLSH
  T1472671908DB34392E0F5A9056F43BD3855B172AE99C65F3EE21069BD0EA3173310F6B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  Exodus/window-state.json
- Size 140B
- SHA256 9a26fa91480b46e766bda682c35dc2b3fcbfddbd9239d01bb081f31d1c767917
- MD5 b00540422a17b0291e542f571317b41d
- SHA1 1f2005440bf035609db9fd76ed2040a06ba2eb92
- SHA512 21420517877bd79b99997a25bca5362ebf95546cc5a283befdae513a2f06ad9fc130147fb241a58d713b548035a799828965085fdcac7b7035d571f9f9d084b4
- TLSH
  T14EC08C28331894B8885241A78A4302A70C9A80242B9A20C9C42C112088930C83724923
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Unsecured Credentials: Credentials In Files

Unsecured Credentials: Credentials In Files

Unsecured Credentials: Credentials In Files

Unsecured Credentials: Credentials In Files

Unsecured Credentials: Credentials In Files

Unsecured Credentials: Credentials In Files

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22