0a43ca8e10ca18d00c5e5cf6cabb5ffe9cda3926a8bd40f3d6b5f12dcd8bd7df

Sharing

Copy URL Twitter E-mail

General

Target
Exodus.rar
Size 144.7MB
Sample260730-28e2zastbs
SHA256 0a43ca8e10ca18d00c5e5cf6cabb5ffe9cda3926a8bd40f3d6b5f12dcd8bd7df
MD5 07b136da870871d7c1ee75048a9f6fd8
SHA1 1d738677b2a6e58aa3fff2cae100c6f1f34e34b9
SHA512 245885ade7f656754b85e33ad0aedde5f222498dd6e11f3bb7187f1b329918790ae05a194b407db0d8753690a6a4f17c0afb50146df9189be17924bbe9046a98
SSDEEP 3145728:UsPEtEjLQ3NwLG0/ORuuXtJ/YvdfkPOES6J488Eb+sS+CyEdj:RE+Qwt2fXT/ufuOEhHH6
TLSH
T10478333F9A0F45805A4DA2BB4BAB016DCEC455D335EFDD01C28C5A821F9A7E54BC8F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  exodus/Exodus Setup.exe
- Size 13.2MB
- SHA256 837beae95e5480b4b9f16e6f3bf89163dca00bb5d74b587a14925e7bd623e28c
- MD5 b41e0e19346f6dad2dd07a133bdf0057
- SHA1 4099b9c5a1704d237552abeddec0a67d63177e32
- SHA512 ee46d74514777ff9d11d12d81f70180b57c4189cdb4c9e900d9e08f2d9108a9ce606f797405c5cc1c5a0d27f35b04199b1f3e3018036252496493c002b214aa9
- SSDEEP 393216:fCrNYTx/hEVbdXQfM6R4RmhiHsnvDwHcBnl:KrSTxYYMc3ggEHu
- TLSH
  T152D633276FB58D98C158BD3A69F18727F3718E110F9645132F511E336AB39E8EF22284
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Loads dropped DLL
behavioral1 behavioral2
- Target
  exodus/runtimes/win-arm64/native/av_libglesv2.dll
- Size 4.0MB
- SHA256 da25c83dc53e69838e8ca21a1526beabe086cb3fcb348fd441e21ed8f917898b
- MD5 470a5ccdce0da2b142f8332e4d431507
- SHA1 296e0b8e93c5374080304e353797f321e1abb6e5
- SHA512 54a8d58ce331a970e84689db582ed20abb702216659fe21eda917d81b1b8852d1879f4d61ec6433257ef6cc47c35ccec0785f0b6fb097aa206586a2d2f86d5e4
- SSDEEP 49152:b6r5zk6oode++IUMZc/rH51CrOtTG2tSLfjN3:b6ri6ooduIU
- TLSH
  T1A5164B04AB4CAC92E5C2F63CDD674F98212BED709021869FB55F414CEEA5BC2E2E7171
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  exodus/runtimes/win-arm64/native/libHarfBuzzSharp.dll
- Size 1.7MB
- SHA256 12ade447cbc51cf31735a609c78906614eb68141a97a3b1745c32db537ace15f
- MD5 7f2fab055aa2b32d8993c43e9adf3482
- SHA1 0eb3df4a6c1a8b0d2118ac177cdfbf9854f4d1ce
- SHA512 e5751762c02cc6bb37b198ce59c25e97e4dd515b37fea8ba79bb38c85895b5d869e87be507813d3d3f41d38d870adcbc464e9696fd4da4df07c4ee7728366929
- SSDEEP 24576:hKn2zaVVdDstuR6xriVjl87Kc80WfKdUt4t5Q33M00ke0Xm4S361g:FKVdguRTl8380WfKdUt4t57em4E61g
- TLSH
  T114858E40DA0DE882DBC2EB3DEC958F603137A9B0C5645CDEA146451CFCD1FD6C5E8AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  exodus/runtimes/win-arm64/native/libSkiaSharp.dll
- Size 7.6MB
- SHA256 58d6071685942c646f4bb110508ebe72c80fc360ed8d8e9afcf1035d99f36bdc
- MD5 4415da0cdca32b651f1422df19ae26eb
- SHA1 c84ae767fcce5ed09f935be0108d367978c5f272
- SHA512 3bf9b3bfad8ffebc0c1046cda8247d1475205c5aff9dc1a9ac9edaaedfc65340b548eeeba36e15d9c6e5aeda701c35e2116ecbdc6b6fe0e9ac9f1accea97619a
- SSDEEP 49152:GVkH9NFrcZtJoNRovXDNzpOxvADks8ihRkgAR7x+JeHXWVY/aOqdNZH5zuTdQh8y:GVkH9HrcZt2zovGxs3W9N3KdPH5z2dxy
- TLSH
  T1CC867D80196DE869E6C2E8FC6E674BD5361AA880CD35868F7036421DDC72BD1DDF72B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  exodus/runtimes/win-x64/native/av_libglesv2.dll
- Size 4.2MB
- SHA256 85b3aee47c0e0eaf3a5ea5c75ba8131387a12639b6a0ef280c28531fb77695ae
- MD5 73d2fb4c35d323813a86e3bf5c85c345
- SHA1 81f751a34e0c25bdea93902a19a94a49ce1495df
- SHA512 e81677cc9b99ff3d54f67000a60489603e01a896f90c4ef0c883b82e2fdb7b90d2899c078958b3f060a20373b99cb6c4deb7f64cc4c7e0ba2a708209f4684ca4
- SSDEEP 49152:I1qISHMa72SRXc0kFg760EvAy4U5hDempTKkslMx0YEQtHhcEIy/rcgcrq8T/2tj:vbMNgMdth1t
- TLSH
  T175167D1AA7B400BAC8BBD139C9175A0BE3F1FC4641B0D70F21B9679A5FA7770626B314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  exodus/runtimes/win-x64/native/libHarfBuzzSharp.dll
- Size 1.5MB
- SHA256 f13d0dae00a598620a436fd991219a2e0fe6157eac90faa025d4d76845cd996c
- MD5 f121a2afb03f1b8ca1784e544464a346
- SHA1 9346297a66989dbe88bc459ee8bf936e7acb3d24
- SHA512 ebbb8c2d7d97521286af0f6b02195890b193e660a28e6b1e5112ed9f1fcc081c66587a7a82c8a9468d1a55d477880487d1b3edf1deb2ea285e17d70fbd56c6f1
- SSDEEP 49152:PBy4VCDmxqVx/1hlcsHI7woyGYdwENWa6m4ys:aQkPNWMs
- TLSH
  T1A575AD4AE26A11E9D9ABD074C656840BD3B274420F14DFFF26E08695EF23EF5167E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  exodus/runtimes/win-x64/native/libSkiaSharp.dll
- Size 9.0MB
- SHA256 c31170c63c00a00b070da2abdfd64fd7f82bb447bab2866a8b547ff45be4a09c
- MD5 6fb7305b1a777bd5d49a12648ac01ef9
- SHA1 df0bf4a232d1e75c27a3928a1a7011e3eae88bf4
- SHA512 39aa7763179aafb3a2a0f5ad85b20f9da394573c74b811d8aced92c9bdc24194356948b483c1f220df10650501859b9de85d085f06101921f8e7b5085a4d5361
- SSDEEP 98304:cjRZLtqNj1FK+Re5fNMVlgpANGuRsUCn+ovoZOXe:oZL8NObV0fGkNee
- TLSH
  T110964A13B66B64ACC04AC474834B99665E2038CB0B35BCEF52C5A1393FB9BF42F79615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  exodus/runtimes/win-x86/native/av_libglesv2.dll
- Size 3.2MB
- SHA256 b5f682067664bf44f92418d57097876b9ffb656c4e1e496d7f056eb3f910e5d8
- MD5 c2b853790468c88c21ec7b6e21959313
- SHA1 54bca8b373eba2196cf47b497734ebe3aaa0d37a
- SHA512 cb885aaaba3a6bb4770d86d0ff6cc6bf499fae945fbf45680bf3682a20bcb4af4b9ecd4e31172cfa090b630d8e749a120d31fd0436e2ffd50efe55146f6744ab
- SSDEEP 49152:9nm84lPJ9YOUCXg4/OuBuitPB5W4pifrmvzrjBTSBYWxXzfjhCAZmfYM:9nhEJSOfQ4/LB9b5WxB
- TLSH
  T18CE59E1278E14436DA5E0270498ABF49E7FCA9112171DB9726BC981EBFF1AC36333356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  exodus/runtimes/win-x86/native/libHarfBuzzSharp.dll
- Size 1.3MB
- SHA256 797b2472ac9cb2457a1cf3db0970fb88f4531c8217fff4b7705decf9a85a19a5
- MD5 1426c6d3cecd7e504db7121caf7be3c5
- SHA1 dfa43f1682b5f988d0f26c38dab3ef38d2cb94bc
- SHA512 b90aa23f9c6ef9d942469f2fd36bab1f700dfd3d867132f0a7c43d42a3cd84957e3564e27db1f93745518b53f9046144a61eecf912c5b272f56ad9374ba2bba9
- SSDEEP 24576:3psAU7vw8DMj0Cl5szcGX5sE0qtSTxleVbXXzskEXbRhrOa:xeI8DEHAcGXCxsBXX/ubvrOa
- TLSH
  T130558D10E413C4A5ED8500F1EABDFA9E25ACDB35032C5CE3A9C0A969FE615F32E35647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  exodus/runtimes/win-x86/native/libSkiaSharp.dll
- Size 7.6MB
- SHA256 29feaf6f6aa8eb88f0225c14dc1d9b0a9f45ab9fb6bef3ca2ab54ea8df658fd7
- MD5 584a3fe755baaf8b09ca8d13a706478d
- SHA1 e60d2a6e5db17d32f7eb06a0b75d8e89f792d887
- SHA512 57a2c38d8128c7a7d7f3012eebeb63b52bf763f168b3b5aa5c057af382bd25ab7d29b92a3df2e03e6191fb60c1ae0bd13de80527d855880f82096804bb14d286
- SSDEEP 98304:DT2Y+JxUTlQBS7WJRQ4cl5eyMsgg6l7kzwp0VKvQl+:7+JxQa9J+4clRsg4wzwp0IQ8
- TLSH
  T13F868D03B293F0FAC44B11F4211EB23F9A350A4857158DEBD7CCADB85AF26D118B756A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  exodus/tr/Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
- Size 15KB
- SHA256 c095fba9868d939e169934cb2eaf155246d10f631ef3ed04bc33febbdb9bfe62
- MD5 40f8973ca3a178b0fbbc669627057380
- SHA1 8e7d0526c8e2f2fa70c5bda9e33c84a925b1af2c
- SHA512 87bb7de944d2d8911bf7148721e94eccc112a9552762d298157ec103a6773a903fcdf6f5af67d5a377090d8733031be1cfa3d7f304d5358dccb8c089a8845baf
- SSDEEP 384:tM1F+kKuWkBfQWPRdHRN7CwuAzXulGswDuEgi:S1I4R33zr
- TLSH
  T1F7723B819BB88503FEBB297152A0E443BE3DB7C76911621E341EE6191F537C2DB24A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  exodus/tr/Microsoft.CodeAnalysis.CSharp.resources.dll
- Size 341KB
- SHA256 8b13ff042e8daff213af548c0e5161d34cb4c26bbb34b338e3bd8e6cd8b8fb59
- MD5 b44fec42b602cc8ac173a2e4e8f0088b
- SHA1 c3d89dbd115178da153edf97af73eec5e0164b22
- SHA512 b2ba0c9cbf3e8dcdfb372c131e3ba6979ba382a018723aa8ad6a879e78abe29a05a05e6e05ba5de87be81161e926c27f8ec45b826019e0f56077bcee1a5ac127
- SSDEEP 6144:IK1aCVBpoR9WjY6CAKQ8ObI/VH37u/OwHG941sEzzNSHTBdR:I9FOza
- TLSH
  T14E74A401B6FD241CF3F71BD9BFF6851ADD6B7DA22B20C24D20094B1F17A4A8646A1736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  exodus/tr/Microsoft.CodeAnalysis.Scripting.resources.dll
- Size 16KB
- SHA256 ede2ca2ac9fc46b7e8fe52e614dbc5d2b3e815b7447ad01e49985ded9bc9fae1
- MD5 a11097ced18582d7d7695f4879f4be64
- SHA1 357f8d71944ea79354d063121747d99987e35a47
- SHA512 25528675719d25656bda092037cd7b75cc4ee616c44f44df05690cd96afa31a8145fa400095f8fa6f5b55b8fb6e4c615b633b805f889f94af7b95bc2261592c3
- SSDEEP 384:0hxGeFULa4jR+NB4RnGoyWPiweWgYdHRN7B9oiFWSlGsQiv:0LG5aOFg2UHP
- TLSH
  T1E3722991D7F84503F9B72E71AA74D9437C3EA7C22920D11F1009E6191FA37C19B64B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  exodus/tr/Microsoft.CodeAnalysis.resources.dll
- Size 38KB
- SHA256 fd867a536d6042ff76e8ae8e9df27d590677d519606b5c804c912b332fcd107a
- MD5 7a43cd5a0044140b3214a84c0cd36f33
- SHA1 c5d62bb2bdc57ea351c09c076582f6f06123ae03
- SHA512 fc4ad0845b6fcdf7823698793742aab6742f9c8d216778bcb19d07d84337e96899626c964f92847c7cc884e992632dc82758e55914d895706664c325dfd2c2d3
- SSDEEP 768:lZSMXZmHiFZv/hLInxC6LeRCtETTUgBJy27n+PMkNwJZ:lgPcZv5voETUgBln+PMkNwJZ
- TLSH
  T10903A541ABFD2409F6F71F75AAB8D65A9C3FBE923D31D01D0005864E1A72B81CAA1737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  exodus/zh-Hans/Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
- Size 15KB
- SHA256 605f9f9db2027e525acebd31fdc18ef0555331aaa6edefb9788b3f63665c8370
- MD5 39e6aa156a26026fa991cb427c26df46
- SHA1 94742c33e0c02e6dd23a8381cae415bfbe26f896
- SHA512 ad20102698c997d2b45fc6c6905497e8cd290d32c17dd2e1440aaae27b2b646927604a09f33da75e8e1cc3d46338c2c4ea9bd58a7d433938f44b63e5ade4c863
- SSDEEP 192:88M1DpU9LNx8TJWkGOqIJ+WG0FW4GD5dHnhWgN7aQWdAoIVFWSqnajKsQiAy:XM1DndWkBfQWPQdHRN7GAoiFWSlGsQi
- TLSH
  T1B86228929B784507E9BB29B14275D5437E3C63D36920921E318EF1681F93BC2DF24A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  exodus/zh-Hans/Microsoft.CodeAnalysis.CSharp.resources.dll
- Size 304KB
- SHA256 4fe71496f14ca29ee38c69bb20915132f43722a01da60ad023951f6e5f7e14a4
- MD5 5da75bcba05cfdbbba83fd7bebf7c470
- SHA1 baed4760c50cf01351ec4e391e2b82ee26ec6e7b
- SHA512 67f9aa4b074fe99a04c6957de1fc88452effdcf17445d8d5b0bf20862efb7ff550826f316baf2856761e6e2e8ea5743d1f6df35be75bb106e871322fd57ec0ee
- SSDEEP 3072:eLbbdyucII3rZYOvY1NIDvzZgwpOfUkYTUbDSXtjhKNNzgsW260dp5zVY9hy9YwV:enG7GwhUbsjhKNNc7JwH3xfbo99
- TLSH
  T15E64754263ED1889F1B35BEC3FB6C158E9367DA25A16D35D245D0B1F0BB0A46CA20B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32