e74150bdf5e9f555955a65234fa61d7779cf05307e3b0f41bd3eec3ba76365ba

Sharing

Copy URL Twitter E-mail

General

Target
EXO AI SOURCE CODE V0.85.rar
Size 19.2MB
Sample260623-m7sjcact3y
SHA256 e74150bdf5e9f555955a65234fa61d7779cf05307e3b0f41bd3eec3ba76365ba
MD5 b6cd5d3669e41aec53367678070344f9
SHA1 900fba65711d529f0eea820b06da633e45e3dc13
SHA512 4efd777267779eadf00202252d34fecf1a6b2e039e71c17756e4e35bc13d08e415f4c2fd27450c227345e3786d14164eaa0606e50950b92eaaab7d004749732d
SSDEEP 393216:vuZcNa2IvPQOdMEOIQpvIdMEOIQpv4t2tYS5ZIyx7LFzdjDE04oq:vOLKOdpOVvIdpOVvHDZj/djpO
TLSH
T13A17336C52AC4FA74CA554796539B4BE60ABC1C150DA3E13CDFC3A980B75BB041B32AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  EXO AI SOURCE CODE V0.85.rar
- Size 19.2MB
- SHA256 e74150bdf5e9f555955a65234fa61d7779cf05307e3b0f41bd3eec3ba76365ba
- MD5 b6cd5d3669e41aec53367678070344f9
- SHA1 900fba65711d529f0eea820b06da633e45e3dc13
- SHA512 4efd777267779eadf00202252d34fecf1a6b2e039e71c17756e4e35bc13d08e415f4c2fd27450c227345e3786d14164eaa0606e50950b92eaaab7d004749732d
- SSDEEP 393216:vuZcNa2IvPQOdMEOIQpvIdMEOIQpv4t2tYS5ZIyx7LFzdjDE04oq:vOLKOdpOVvIdpOVvHDZj/djpO
- TLSH
  T13A17336C52AC4FA74CA554796539B4BE60ABC1C150DA3E13CDFC3A980B75BB041B32AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  EXO AI SOURCE CODE V0.85/Exoai.py
- Size 47KB
- SHA256 8cc5213b35bbc0b6ef13a98c617b814dde9d5f92637e2a9e09088dfafa31fb8f
- MD5 2b3aaeee153957e2a687d1f59dc43ccb
- SHA1 894968eaaf4fba1516aea37729a981bc600a9f84
- SHA512 7b8a808f031cdd731840348baa6d509e42f3b51ddd90c681152b7a56884dafca198f22c50888f9cec768d0d898223fba454d0b886900ab1fe5363330ac878d9d
- SSDEEP 384:nKM/DoTZSCuZOGHps5/mjQP8OlqEF0TlHoWjXYwxesQfHlq2j+VQommI0P5:nKMboTZS0DBqEF0Uvlq2CGLyP5
- TLSH
  T1792376362C0958019177DB1B95A78A46DD4512C38B325E32BB7CD2688FB10C1D9E9FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  EXO AI SOURCE CODE V0.85/Flash_RP/Misc_data/frosted.py
- Size 1KB
- SHA256 f561d9a31b876489197d6c451a5c328e79e2ab9b7d8bc6167f61e361afada92a
- MD5 bb730fe9ae1b69bc9af69aaac2cac7e0
- SHA1 d077eaccbc2103723a4d1c4b0d79490e015a4a00
- SHA512 55d118dd3e0495eefb276c6d70415ae8f3d590b8f64f80cf64f3d3e81ac661b76866594f926bbd2a636e0faab9dc29ba08023c082277358e9005f164d210d6f5
- TLSH
  T13521CB206C0DCB644B339209EA1993999E10A11F29B94E1F372C80362F3B43EE0A4F65
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral5 behavioral6
- Target
  EXO AI SOURCE CODE V0.85/Flash_RP/Misc_data/style.py
- Size 7KB
- SHA256 e2dc45c0490f3225db0626a195772c7bdef78f1987b00b8e55661781c80dc356
- MD5 cf9c89b2bd79bfc68054c7991368d02a
- SHA1 2192d813c24b02595ea2c82db996491596ece905
- SHA512 567f484132694c0ec655c705fd3868d947398ab7db7f2ae0e304a1252390d66c66203912cd9e89022f909a89a1afda418865c97a349b9df820c7017274b4f468
- SSDEEP 96:DxaYkxyth2l7Ae8JV/RqUg/LzFVEiWIDIPzM9Ai:DfkQMd8JVsP/LzFVEiW2WM9Ai
- TLSH
  T123E1E1D8DA894C873239CB7AB371C581FF4A12638A020B7D7BEC72644F745681879D89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  EXO AI SOURCE CODE V0.85/Flash_RP/flash_rp.py
- Size 44KB
- SHA256 598277201b6ade648c97ff21b104b923ae875be24c68bc820924fe67e7bee532
- MD5 96dbf79cdd4d04c4c4f40f48f4a13bd5
- SHA1 655dd9626e5af46aa4fae736f6b4d1674676c017
- SHA512 3739164a3a72795300d22f20bc673357d71c21d375acc0c89ce11efe74ee0ee8470cd79194678c688be483ce9399aa0d632e9cfc3f0bea90415f47a3d28fce00
- SSDEEP 768:knMNbVd5uPoIOoqe9BGtYf0NfQwf+CP2umNlVdLsNglRdY1DSzRqaJgss3h2zA:k+bVd5uPoIOojAQwf+CP/4lVdLsNglRm
- TLSH
  T16E13832AAD069416A273CA2B68B37983EE4A010351BA4E397B3DD4145F74050DAF5FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  EXO AI SOURCE CODE V0.85/bypass_exoai_login.py
- Size 835B
- SHA256 de708ef39608f5cec0bb46db69bc29beb69fd8b3db3abe379f78411e81f2af81
- MD5 293a4e1979105a06e97e8c9396c9e368
- SHA1 c9249b713e40b0511b17a299f8077d786ea33e8f
- SHA512 21aace4c4c2d3cfb7e90f16aa88a60df17bb044b8fbe842350baec992dbf3ee15fde2938e025c1d5734c838a03100d3ea6e6fc96e965282f3d5c62ca518957fb
- TLSH
  T1C601B15A28813821C743D12EA518F69A8B6F7D37520D38B4BABC91C42FA5126C5ED9FC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  EXO AI SOURCE CODE V0.85/install_exoai.bat
- Size 1KB
- SHA256 9012f725a438f5dc39a32757ca4e4ce0ef8c4257e81ba37aed940b6f197ac5ae
- MD5 94d9703f86064edda75321a4a971c91f
- SHA1 7ee433d704df9d42aca96884477ce399fc9aefaf
- SHA512 6f57db8b88ff2e894658ee6adbd7e6d40a451d3e193850076e8060c906137940d7ceca6c45ccd1c1a0711e60c2f3cf265cfce44b932dcf54e4aebf7b1dac0805
- TLSH
  T149318404230AD33223B5C2B6D363A024E75871470B248EA4B5EBB1E40F66194DAF74DF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  EXO AI SOURCE CODE V0.85/launcher.py
- Size 1KB
- SHA256 9dd2c9397d9d472b434a48cff15bd2ff223c1f35bf6bfd26dfc5923a9b849153
- MD5 877b75cd733088555b27e52ffc4450d9
- SHA1 0968d071a3cf33178b2c84dfba8cecdec90acf0f
- SHA512 c1f6822197741228e99e1bbaba0dd7412bf8aaef81f74ce27a08839f23de3f140379dd7320e811445181bcd1543222a050466346f6e289a47aaa612904a78a7c
- TLSH
  T1591112676C8E95A141B1C16DA20E8975EB7E585737169F76F16C83F40FF0A08C8904DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  EXO AI SOURCE CODE V0.85/lib/assets/arrow-down-light.svg
- Size 471B
- SHA256 0502793a76b13800ae6e85c006f4e55d4f107560b352a2e845f17ac50c0ccc9d
- MD5 765a018b78d18723aad5b94ebdd0791b
- SHA1 e5dc3cef7353efac0cff313e6d97510b9ba9f194
- SHA512 6324b7eb7d8f0f87bce2e18c466656f081ac1d0aa030f044adf798cc829a15551129f7132fcd74244b764a70f2b22ac699cd6593aa80cbae40ba8e164ad2dfda
- TLSH
  T1D3F052A8E51C890F80C9417C39208166271E5CA3B08E9C5DA40E0A236806DBD9AABEA6
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral17 behavioral18
- Target
  EXO AI SOURCE CODE V0.85/lib/frosted.py
- Size 1KB
- SHA256 f561d9a31b876489197d6c451a5c328e79e2ab9b7d8bc6167f61e361afada92a
- MD5 bb730fe9ae1b69bc9af69aaac2cac7e0
- SHA1 d077eaccbc2103723a4d1c4b0d79490e015a4a00
- SHA512 55d118dd3e0495eefb276c6d70415ae8f3d590b8f64f80cf64f3d3e81ac661b76866594f926bbd2a636e0faab9dc29ba08023c082277358e9005f164d210d6f5
- TLSH
  T13521CB206C0DCB644B339209EA1993999E10A11F29B94E1F372C80362F3B43EE0A4F65
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  EXO AI SOURCE CODE V0.85/lib/gtx gpu installer/install_cuda118_gtx.bat
- Size 3KB
- SHA256 881bdd95651498550ad8748a99e0a5699644a2aae6eeb1cb9bac3746cb275a0c
- MD5 62756fbe7048d715371dcace04dc7252
- SHA1 7c5431015420a444581f39533d94eef4bbbcf15f
- SHA512 a856a480c8801b9705dfacacceecbcc456ba63f768a941a4a1d829895355735b9567f25542d9df8081b35862fa85436c2f2969a63609e8baf08b654a65d947a1
- TLSH
  T1F16130063021A27272F4ABAAEA7209B4F364F5D717256C50F0A706741F1A3D13AEFDD9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  EXO AI SOURCE CODE V0.85/lib/gtx gpu installer/uninstall_torch_cuda.bat
- Size 1KB
- SHA256 66b05dc4763454288944e987193504840a38e05371a534a79ddbb0b36f0a3856
- MD5 5e9df6b438c8b8589ef8fdf42d22d80f
- SHA1 f99fa131a731613409f84a6367faaf44e452f1bd
- SHA512 8d33e8886188ec5649f3d2acedf0f8317f97af8690bdb6e32035cc107f044c9327f966c510be614f5181627fd60c1d4f423e8834c0d17d45571617ff6c56aa1d
- TLSH
  T17E41AE0372085FB679E8DB64E9360011BBC8B1973B254C68F5D781B05E57B823B7AAC9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  EXO AI SOURCE CODE V0.85/lib/main.py
- Size 29KB
- SHA256 9f382ba206869c67fa8c0f275e1234663638d0f4ba37a8802d1968f56a4da9d2
- MD5 d0f3a2898c1eb52c765f749464d9921f
- SHA1 a62466530fb36aa857d3cb6e7d1ef69faaaa2212
- SHA512 bdfbe7987eb2ea9891185203ad960b8f563489335db8fe93338c51fbabe2922f7f9a09559bf28e88df6061ee6bb312752d9669d984e9ac492b10df852220a4da
- SSDEEP 384:Kte9PZs1zdnNbLIiKRrXHjUfTrdDwc4079JDrjopmX0NyIRhDQj7QdPImBlXv1W5:KUqnd7rrcDJdvuPunx6S82U
- TLSH
  T12BD273772C035A028473460D4D46C9AAF36257DB067B7413FAEC92452FF0A9A52E8BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  EXO AI SOURCE CODE V0.85/lib/rtx gpu installer/install_cuda126.bat
- Size 3KB
- SHA256 fe164d60b75fc0f936d27b825caf9a59a2b3be1e4a722b8f4ffb966d1a8c4a4b
- MD5 9d5515d75c82204ae9f40236c23f78d3
- SHA1 a5bd51bc05321113f7ae61e7e90a55a819f95a27
- SHA512 a111235a869d7a92906138ffc85756a525b316df6839f548c97fc25478b4bd56509e4dd5b990c6210a463b8d52d28824322111381d0327fc0379a5f16bd70999
- TLSH
  T1E4710D0B3210A6B6B1F09FE9EE360670F362A4C717255C24F1AB42740B097D576AFCDA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  EXO AI SOURCE CODE V0.85/lib/rtx gpu installer/install_cuda128_rtx50.bat
- Size 3KB
- SHA256 6e8ecddb8a71333261785618954a3fc4dccd337db2274af27529e3f72806fea9
- MD5 da4a36282af51680535bb6f1aa64a303
- SHA1 5f8768936c3202528581f36c8fb2da73a324c284
- SHA512 f99d32836d35a27d08b268e9ab52acd434116c42ba94d931e2d45b7cb55d9a8aa380d0ae709dbe0570c4549c6ffd216e7cffa5dbcc1649d2343c1e7c51a199d0
- TLSH
  T1BD713D0B3200A276B1F19FA9AE360570F762A0CB17256C24F1AB02740B097D577AFCDA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  EXO AI SOURCE CODE V0.85/lib/rtx gpu installer/uninstall_torch_cuda.bat
- Size 1KB
- SHA256 66b05dc4763454288944e987193504840a38e05371a534a79ddbb0b36f0a3856
- MD5 5e9df6b438c8b8589ef8fdf42d22d80f
- SHA1 f99fa131a731613409f84a6367faaf44e452f1bd
- SHA512 8d33e8886188ec5649f3d2acedf0f8317f97af8690bdb6e32035cc107f044c9327f966c510be614f5181627fd60c1d4f423e8834c0d17d45571617ff6c56aa1d
- TLSH
  T17E41AE0372085FB679E8DB64E9360011BBC8B1973B254C68F5D781B05E57B823B7AAC9
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32