Extracted

• • Target
    https://release-assets.githubusercontent.com/github-production-release-asset/1279256675/d516373e-35c0-4419-b910-a5092c8d86e7?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-06-25T08%3A30%3A01Z&rscd=attachment%3B+filename%3DExodus-Fake-Balance-Release.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-06-25T07%3A29%3A46Z&ske=2026-06-25T08%3A30%3A01Z&sks=b&skv=2018-11-09&sig=yJpKaNWS%2F8lUtJtPFwoldWnrE6YJe8LmZH%2FOsyNVv7I%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4MjM3NDQzNiwibmJmIjoxNzgyMzcyNjM2LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.4HmJNBC01FKrboP_PjXToqKY8Zs5bNM12ju1peuWuoM&response-content-disposition=attachment%3B%20filename%3DExodus-Fake-Balance-Release.zip&response-content-type=application%2Foctet-stream

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1