b1c44a83d0a6e7c3194e0bf08ab60fcbb071543b43a1d6bb8f6e8009650e74a1

Sharing

Copy URL Twitter E-mail

General

Target
Exodus 6.rar
Size 953KB
Sample260728-mg5e8avvf1
SHA256 b1c44a83d0a6e7c3194e0bf08ab60fcbb071543b43a1d6bb8f6e8009650e74a1
MD5 92cc498cc559c8e4abc70a2b7a15f3c3
SHA1 5fc83a75797c4ed3bc0bb84537098812e37d4dd0
SHA512 5c415f0e764275d4803fd80ea5ce30ec10c4cfe221995de7d669e48132d19e57e92ea14ba346e913b7c7eff6ec8dee405a5dae3406bff9430dc16c9616276d1f
SSDEEP 24576:y+2VCiZjz9NlbkCySCIgvUxDbJhGPHeKZe1:y2iZv9NlbkCyS35D3WHxZs
TLSH
T1E525336B6977E7B3E5277C7D848C92DF5C73328828B0A7E5FD85C8AA82C244BD0581C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Exodus 6.rar
- Size 953KB
- SHA256 b1c44a83d0a6e7c3194e0bf08ab60fcbb071543b43a1d6bb8f6e8009650e74a1
- MD5 92cc498cc559c8e4abc70a2b7a15f3c3
- SHA1 5fc83a75797c4ed3bc0bb84537098812e37d4dd0
- SHA512 5c415f0e764275d4803fd80ea5ce30ec10c4cfe221995de7d669e48132d19e57e92ea14ba346e913b7c7eff6ec8dee405a5dae3406bff9430dc16c9616276d1f
- SSDEEP 24576:y+2VCiZjz9NlbkCySCIgvUxDbJhGPHeKZe1:y2iZv9NlbkCyS35D3WHxZs
- TLSH
  T1E525336B6977E7B3E5277C7D848C92DF5C73328828B0A7E5FD85C8AA82C244BD0581C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral1 behavioral2
- Target
  Exodus/announcements.json
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Exodus/exodus.conf.json
- Size 2KB
- SHA256 1174f940c66074d95f10e093db67535653b8ece7590a99dd3df6291aabc5f539
- MD5 e9c22271de678a55cdc319d8f596f5c1
- SHA1 605ffb9d82bb0decae45cf551c1c046d5b521a2d
- SHA512 9c0b0a045aabcb9889efc6a941443bb34a03810d7582c66dac3b4574f4ff1c143606c6d9321314633ed553718ae79077a471b399c90f81e2904f93fb16cae7c9
- TLSH
  T17E41CF28D5B41CB709D6B1BA4C7F2153B53080AB4D183C383A9D564C5F0EA3D15AEBFA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Exodus/exodus.wallet/info.seco
- Size 32KB
- SHA256 4f1068397bd73b3652caba6a112537bf079ac379b18a2e00f435820a3e3da85d
- MD5 0b3c1dc3a446ffd427df58dbfd19ac75
- SHA1 6dc98435a48db98e16ad8bd30a57bf92d3c75bf0
- SHA512 f8227cd7ae9abaccc41e5f5f5bf23f19398b8f34c73c1ee6bff7fbddd81c42bc00089d1532e27e5626585aba53e3b221b1e013bfaed4cc8271bcd13507bbd1f3
- SSDEEP 768:KVJZjwiOYwqXlAbXEOkT7sG5cWXv770qp:KV/5OzqXlGXZkPt5Xfp
- TLSH
  T13CE2F10A4576EB80C9C9D776B7E8FE8A9952FD217B81E10DE7FE2480543B8B4084536B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access execution stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral7 behavioral8
- Target
  Exodus/exodus.wallet/seed.seco
- Size 32KB
- SHA256 13949f48d4f81bb09f86af153ca4cbe82cc8ba17becd269ac801c5a0970dec21
- MD5 c60a10416782424fe87b1a0d76e3f0df
- SHA1 1a41b90b0c11e842e04bb59f0a7f1dd789c35715
- SHA512 c45e8bbf6e2cbd705c2aa4fa954fa90879c0037550b799e0918e9ef74f30b7a892855ba7940f3bfffb79ec9021c7c23f78334153a539a6202c19df089ac27fdc
- SSDEEP 768:HL+1SZOid8ixdVxsinb7pIUTE940OS45Ouk1fGcbzyd1r8:HL+UF80/nb7M940OSjuE+K7
- TLSH
  T160E2F11C857A8DEEC366033BF4EB9DC01D653821E75221184983765ED8C5F9EF8CCA29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access execution stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral10 behavioral9
- Target
  Exodus/exodus.wallet/twofactor-secret.seco
- Size 32KB
- SHA256 ee41ace58a1a04fe51aeba94278a9b6c2dc1305752d38ec2751845234a85a9d6
- MD5 470e94f2554879136a121ecfa94adbb6
- SHA1 3fb0785c5db30080cffe05a35e719dada5e648ca
- SHA512 66d0c75402f25aefffbd7e7faec8537a9682718ba7dab91b985181b0417f881e20fd48059ab72a8a760974f602d3ea37aec445f187733a000c9dac6d1a3b9655
- SSDEEP 768:M3TVDXftMtIJnYvVZjoatrY7slUAI7fhAvkz7:M3TVjG6nYvV7UJ7JAC
- TLSH
  T149E2F1AF613030FCFA621D3EF7C3250029AED13B5208770955596EFAD61A649AF620F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access execution stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral11 behavioral12
- Target
  Exodus/exodus.wallet/twofactor.seco
- Size 32KB
- SHA256 734593557b36868269ee5a8aeb398ed34f813bd73766964f0609fc92bd600ae7
- MD5 c550d603ba0b88c4c57888d9c5dee5fc
- SHA1 84921e285d885e803007276246512ae9c187d8fb
- SHA512 7fb5d691f9a2209f0ed72b0f4ad09833c51e5b9c45f81b3bd32e14c4f5462c609608c21deca0902e5363741337b0fc19074bbfa9861bb5071cbae0d3b32799df
- SSDEEP 768:8BZbU6QI9HI/rsG7szK++ST1OhLgqU3kbt8KdIYaGMIS+c4:8BIEHID7szK+9TPqU3wJIYaGMx4
- TLSH
  T1F0E2E1F975A98364FE50DF30BBD44328FEE00D930D9716C4669932960A0B7C19B77A19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

credential_access execution stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
behavioral13 behavioral14
- Target
  Exodus/market-history-cache.json
- Size 3.1MB
- SHA256 fc1758b0c233bec8841a9e39a43dd6653f5dc2c2811ade1120293f762e24f23a
- MD5 8f3aaf873d9f0f227b605d8b7a9647f3
- SHA1 e3a58b9b9543a833c49ddb689c0b9be03fec99d2
- SHA512 4cc58bb184f69f331aae722c4d28ab2af6454ad136513964ddab5961368412ad7e808526876a197e2e5493b4f2966536bf4a7343f3f1697eb4e00b64110176e8
- SSDEEP 1536:vwgq5z0iJusfAj9WqJeSltkYmBDUb1+3avyjVEDokbJXMMmcvbY+XgfeVJaLuw/j:hftZkiUU8etFbTBLL3u
- TLSH
  T11BE56390CDB34396E0F5AA042F57BD3814B571AE98C65F6EE21069BD0EA3177320F6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Exodus/window-state.json
- Size 140B
- SHA256 8beeaa82116f5825a3b1d79bca8130ad00edbf3f698b5101dd4d3ae22b24fe5c
- MD5 3e1aa13ea3b4a03b33242c35ae08baeb
- SHA1 1bd6ce352f325d9c4ce5ac0a04fc4a104927d9a5
- SHA512 d452b02c269d865f336785f01f78a858508fc56e5012358805c9220ace2681cdf688f6a44d5e8804ad0cfa0e269c54ee6503e931b11d13fd4c56e575036980b0
- TLSH
  T1DBC08C28A60490A8C5A2244B8B7302530EDDE4283B9B2084C02C280088521D83B25423
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18