6158c4944f310772a739e38292eaef9d521b6c038e31a101f88342483a2982c1

Sharing

Copy URL Twitter E-mail

General

Target
exodus larp HQ.zip
Size 119.0MB
Sample260806-xmkccassct
SHA256 6158c4944f310772a739e38292eaef9d521b6c038e31a101f88342483a2982c1
MD5 5821d224f011fde81971734a72b087e1
SHA1 7456bfb22776664c9e3ceacd8f978cec077ae3b5
SHA512 787015e96acad9e09cad2966bdcb8e9d2676b5d57536b84c89939bfac0a5f8f3a73b91c8ed550a8fa69aa9aaf15af091db5c944c2b9d7c7ac7ff16022550932e
SSDEEP 3145728:HDSEXDCRQVKdIbGMJcGL5A0I9h3PEDGcmwPpxSMg4LMu6w:j3UhISV4LI9hfEDGXwPm14Iu6w
TLSH
T1105833E1B5991F39F4066231D61F7ED806E4E09B7C0BCC1EEC5AD7D6819028B3A7588B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  exodus larp HQ.zip
- Size 119.0MB
- SHA256 6158c4944f310772a739e38292eaef9d521b6c038e31a101f88342483a2982c1
- MD5 5821d224f011fde81971734a72b087e1
- SHA1 7456bfb22776664c9e3ceacd8f978cec077ae3b5
- SHA512 787015e96acad9e09cad2966bdcb8e9d2676b5d57536b84c89939bfac0a5f8f3a73b91c8ed550a8fa69aa9aaf15af091db5c944c2b9d7c7ac7ff16022550932e
- SSDEEP 3145728:HDSEXDCRQVKdIbGMJcGL5A0I9h3PEDGcmwPpxSMg4LMu6w:j3UhISV4LI9hfEDGXwPm14Iu6w
- TLSH
  T1105833E1B5991F39F4066231D61F7ED806E4E09B7C0BCC1EEC5AD7D6819028B3A7588B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Base.dll
- Size 1.7MB
- SHA256 8f0a12e7134d617f0bdcb0167479dd0c17de4bce192fc779b5673424470aa2cf
- MD5 0442decd1c27e119fbf93ac9b62fadd2
- SHA1 30cdb1bac361695151bd47714465f9e8f95d9b44
- SHA512 d3d80a236326fe6530a7c8705027e61832fe9352057f1b3341e525d01ce680016f640c63d8252fba12688544a86f5dd7998735e74f75808425f3e3433e095f50
- SSDEEP 24576:0CqLvtPLslmTX4/e5O0HD7ICdktbsETZaPQ2AXzkai34rTyqmWfDN:fQpLslmk/8O0eBFrTF
- TLSH
  T1B0855B45FBD90F26C5EF8A7AD0318A255771D03A7391D78B5A85AE782C833B00F197B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Controls.dll
- Size 945KB
- SHA256 96b2fe74060a3727fc88c4f134516c1b6bd6539a111ab80585df4fa3e45c6bec
- MD5 750a953ce3447aaff55df2567123f8a7
- SHA1 26f3b93374d8e202d5d54a6fd5a5efc1646c186f
- SHA512 25ac4074f3ef8a4693a55a86036e0dc5336ada7e7644f8657b8b80bdb803a6afec0367b43afe8d1b0eec2f316c894d94f8f23bb614bff2f8cbb27dccbfe0f272
- SSDEEP 24576:CXJHur736XQevAxdjI6TN9NERCMHETy5zMnXziVT:+XQKLHzKXk
- TLSH
  T10E256D5133688A6AC98F1B35E071051487B1D56BE7F2E39F2B427AEC2CC7B694C4817B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.DesignerSupport.dll
- Size 204KB
- SHA256 6f6203d0c2b3867202bba824901d5dcba4b568ce560a97e68b2cd7f78e390338
- MD5 9d1c21d3234b6be58bdf5d707c438c32
- SHA1 9553d1c623229ba73e2c38fd2c15703965583de6
- SHA512 3e3b2314cf18a663933506013ce9122e3d1c52fec8803576f069b12d6edf8ede12caa47bbe4679eb32883a41042856d88a6fbf53b4422e68e5375f0fa862f5fe
- SSDEEP 6144:5epkXoiDNR8XaC8KMUZjc5rlFEkdLQcu:5B9DNRYaCzAE
- TLSH
  T15214D081836D4223CEAF4A7A70FA31470BF7B54369E2D7CA9F58F1E90A973400A14767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Desktop.dll
- Size 15KB
- SHA256 d9b6df687c86a43d6b8ee385f27856da281e08338be3b05057fc134de4be6c6e
- MD5 7e89c4dfdb6ec116a6d068afe20905c1
- SHA1 dd2a8048a58fb3bdb4823170f7981d43159ee29f
- SHA512 fd41e790c4c39d46ec5d9b50178ef55297c524937c33c0fe13d4391387a0cc940a0f4f6b78cd770442838027bdafe850f6db9554d771881d96c236d9a613acfc
- SSDEEP 192:4WRYqVmaWisAgY6DMZPGlFbnQNxTQWxK:4WdpsYZr5
- TLSH
  T13562A7D593045273ECD24E32B9FEF8926136B682ADE2CB565230734AC857B340F65F29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Dialogs.dll
- Size 228KB
- SHA256 62485d2fec62151f1c3771196916d1336704437e4234a02d944d72058c6a0250
- MD5 d983836ef3d7fa7d4d2571c9f2b6c018
- SHA1 78b04b023f52836555dc2c408c414fd3ed5389df
- SHA512 5c57c5a06be130746b024b9ce7c7c7b212b80c461d91178a7dad6ed9b0de5b0a62e38f6af879f48d0493c871e4d2d9bc1954a4d5b0d2ffcb1e6a0672027de08a
- SSDEEP 3072:EEaNiXlLgbEmk0/Dv6QKwRr4T2EUtxq2FquPt3/yzBuNOIOU7og2FncpqnFxbl0o:qOqXpSIE6Ey/SmWUMxFncpqDbSb
- TLSH
  T196343900D244AB39CAE6E6787C7CB3BE0975F41AFC9AA61334D5AB3145C5910ED18BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Fonts.Inter.dll
- Size 2.4MB
- SHA256 ac72898b6ceb35ae50ccb816af6e7ec32defc6667725b624507555fc81dfcae4
- MD5 fdf923002820c030f60a809dbee7c4c5
- SHA1 16fa81cbaab5ba436232bf928f026f19ce4ead1c
- SHA512 07b51f751a14e6a93bbfdfed7ca5111ab766b38fd742c7476fac74a8346876ba634b4664fbd31299e9e346ddc832e4de3ca0c0362b485a5665f3826018644f84
- SSDEEP 24576:7GfUawvIQdG+ue17V0hL+QZr/GpRAkik+WABkLGm7K7ZLQQtyQ8YG8a5iDGWDSW3:dF16ORAki2LqpDGWDSWaJsnzXwI
- TLSH
  T174C56C13E31AD709D9122C3986F18BD13369FCA17A0BD29B706E3A69C8D71F40AC75E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.FreeDesktop.dll
- Size 199KB
- SHA256 5ef12f8fc03f34bdfd99394ce2c39847be632bb3c3959949d931031a0416f7dd
- MD5 aa744f5f65d6c0abd9332f18592be1a9
- SHA1 2058713b8ce545ffc551bfba1017ee9f8c17861e
- SHA512 42048f3af4a0815952ae731073e1fe54be2e2c705c430219e94d39e6c4d10d1255eb3de3750e2ced96b24dd0a3b469594b2efaaf2ff341ddf434bf68b32da3af
- SSDEEP 3072:AY+8fK1QwjYxTHwRiBbcoXcP0rprdYJjmlZgbNVP3i6cT+9L5Yd:TyPIHJPXccdrdsDVPRx9
- TLSH
  T13B143A36A3F84B02F6EF2B7DE5E864158737B81A98AAFB4D5C4D68DC05A33409C05763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Markup.Xaml.dll
- Size 75KB
- SHA256 86a3eeaa9b507e71fd91398add6c1bcb2e424d65da3221ce943ca637d771c510
- MD5 6989c9e9d2188f9f6ecf1555edacd268
- SHA1 9c384fcb9bcdd75d26d0b779252d2195ceca3c01
- SHA512 592912567ebd03ad9b781bbcf26dc06d3b1cd2eed5ab06936534f418519eaef0b7e1f3841433869a29a601ce920ba34142894505a4a4777e3ba4de7f712f6221
- SSDEEP 1536:fwWOWR6jFvpUOZ4NEc2VUD6bTmHcdY1bbk4:JQ4NlSmHSYNP
- TLSH
  T14D735C51A3BCC326CFFEA635B8B931130735BA86B5E1E71A9B14F2D55813B640E407B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Markup.dll
- Size 66KB
- SHA256 032576788b40e65f94f908d2a9f26a62c1b80b7b133e2bd97f31571262f93c8d
- MD5 c8a48fe1817998d608909712d39eea6e
- SHA1 9b67ae0c3e9649eb5b06cd81622e9163375082a6
- SHA512 c692e915cfa73d9d109355b521e1a4b3a8a68e8a5e08e46d6e8ea60bcd038e108e82c34b2416b51b64ec2a6ca887eccec7b6483897c6e9ab3804935e8d8f7261
- SSDEEP 1536:yaL8mU7EXt0fvik4jqfgYg/MUcEfVv6NGYuEN:4mU7FP4jqfgl/MUqNGYuK
- TLSH
  T1C8632A6437A94316EBEE0B79B4BCB7100771B5A776F1E79A5A28A1CA1917F100F10F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Metal.dll
- Size 14KB
- SHA256 11842f337b791d7d181d386f8be63e4f7fc8dc4d0c012426b190011b5228e45b
- MD5 81f795b0f6e35ae30edeeed5887b2e0b
- SHA1 46b95fbc5938391e35af960f763680a03cf40a12
- SHA512 884d669d3dfb01dd05ac2c91bacb87b7b56c8f57f20be21e09f18ecd13d8caaf0cd4ac82e9080a784c342a2961225111356167e883a92b4903d19f1a9b24ecf7
- SSDEEP 192:beVCX9NQVitAgY6DMZPGLFbh+2fJaOJxP:0u5YZ2+2L
- TLSH
  T16C52A7D0D3042173ECD28A3275FEF8926276B682ADF28B5566707346C817B340F56F15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.MicroCom.dll
- Size 15KB
- SHA256 1cfbb23f757a19afcae54e9758050f2bf8b101b31b78c9effdb53e2a7dcb526d
- MD5 24d31fb8ae39564ca0a9b1f211ef4c85
- SHA1 e4efc99d19d26d4bd87bd5deaa103aa926709c98
- SHA512 6062bf1baf7c0015831d312db9d7556a2aab3d8950e46535c5ade7daea47fc03cdbb003049f2d59d0af90b63b00942d3a33959a3e647ed9c420f1ea7a01ed071
- SSDEEP 192:tRg9FzkwgiJAgY6DMZPGBFbPufe2wxMkqxF:Hm4wb1YZ4Ee2J
- TLSH
  T15D62B7D5930452B3ECD28A32B5EEF9D2623BB682FDE2875562307346C816B340F66F15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Native.dll
- Size 260KB
- SHA256 12387854688e1b8795af6e6b561e6a0219f6ccafa392aa9d61b97163a5d656cd
- MD5 04660aaa4a2867648238347ce1fe7ab4
- SHA1 025f840266d115e986b196f6969723b3217a4957
- SHA512 f83c4b90d89ab52d51b1eed83a89326e780e5052fd3955d1d2f5cbaebedfa767fde40a90f5e363b24e4458df319091f5e781b8b709f242684ddf1057e1cf574d
- SSDEEP 3072:Y7KFJhf8NGi0279smctdmuWzg5+Sy9TCAFze2eira7U+6Cy4Rq3k44PUPCD3wbdm:YOJaCQsmk/5+SqXfaN6CyQzdD3wUJb
- TLSH
  T1E7442A512FE8DE16C9FF06B0A56812134730F047A253FB8B8958EA796C63B50ACCF5D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.OpenGL.dll
- Size 93KB
- SHA256 4bc9c53d8b224322bb0315af3da45fb68f6654f45cc2a963422917cdb2301fa7
- MD5 60a0c1e8dda246911dcf7e60aaeb9314
- SHA1 43c0ba97992105c7c8bc19c9e8a15cf4151f8f6c
- SHA512 ae169dd8cea35523a49ea32e1739d66e8c5f4c34869b17aadd16793b758be0d9d37a0acd8f16d439b8034e0197b9038cd9931dcc3aded9da7ca982538fd2b28d
- SSDEEP 1536:9pzyeehFyHhrLZZRZV4wpXhHTdWDP3P7gcLT0DJfPs/j61TGY6tbigyot:9HehFsNHTdWDPUceUY6th
- TLSH
  T175934B1163DE5222FABF81F6F8743C895376B8D664D3D7AE8C44A0F919E23088A51737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.ReactiveUI.dll
- Size 35KB
- SHA256 a88c3dc9149a5a0a5c86ade48108c06c7e144b7716227d48ca82fdcb528509be
- MD5 1a1e4a0a13139b371d813977c1dc3b0f
- SHA1 da1f0be7375fdbea76f519653649eebb0c4647f1
- SHA512 b0b374b8248bee087a9574a5892e9a4f8276baac41e15f878bd043e6b764d2d23ab4dd40602c8b43dbac2b90237a725c797a571b2904afbe6d4d85256d6c64f0
- SSDEEP 768:9HquTfEk7SqgMMMMMMMMMMMHQqXf4NvIHgdPpYZCv:9Np+qQqASCYYv
- TLSH
  T1EAF21BD1A3045322DAE34B7779FDB48A1236B9C368E1D7996668B2DC4857B200F11B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Remote.Protocol.dll
- Size 68KB
- SHA256 6fd25cd20d4e0e085f02bcb22a063526b1ca7a9c26f69113d4897bcd705f1e7b
- MD5 87886e3819fc913245c4aa376750cf9a
- SHA1 6f2a03daa12bba0e28422aa64e2b50d7ffe6520e
- SHA512 59af8be70c4c78c1faa3b685b2cf2078f190b0b6c141a8bec23fe46a2be8ef41df104b9c9206ccc4264f29820ff34bc05500db87dad33288d853f746e8128c59
- SSDEEP 1536:xwFdXsoZjwzCJIkJNZGOdRlg5HnH5knn1GL3vYhj:khtZjwzCJ5YOdRlu5Gnm3vY1
- TLSH
  T105635A90E3589777CA9E4B75B0AEB1114376F3467ED3E7436E48E2E9A8473600E0076B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Skia.dll
- Size 105KB
- SHA256 d4ed40ae7191470d1711c765e8d9dab70cfdc6c3d4da48b941135cbf8762b8d8
- MD5 6e6b5f43a3873b947a3a56df89e07ef3
- SHA1 82a81bea76de0dd967c685e87752903cb26380a9
- SHA512 e03e6f91858c100d388c9b4d248e7490a938a241296a12fab04c486a3c463ff69a692ca4e7ff531bf528245526757f1ca3b597daae983ad2bb496c9960338f0a
- SSDEEP 1536:RcuHILEqgbWdF24PVwOknuUPbzmg1fXt+GVmpidtxSS1Mk2gRiU9p4Y66Z:R+fawQhGGVJdtxS+MknYU4Yj
- TLSH
  T111B36C5917198637EA9F0A7AB0F434500771F653F5E3EB4A4D80B6AE2CB33904E15367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Themes.Fluent.dll
- Size 750KB
- SHA256 59240a98e5bcaf365faa40bd8e4897a3a06180fa531047283a06dda474a838b1
- MD5 983d0fb39b48add936ecd0d7a1c4cc17
- SHA1 e3b878a4499a8ee5a07a267969848077bf70ab21
- SHA512 343cd1d09200ea43476dabaf3010540d1e913db98dac631766cd491bed5918b77667ed5ed25fbcee5beb69d84a975aa36860b4337be966c3086fca7e56e67fa6
- SSDEEP 6144:n8YEoD9UYaNTbw6bJ/l2gkxm//YBrq/C1I:nD3S06IW3
- TLSH
  T11CF4215A67A9D801D3BC91F53378714B88B8E7366732C2CD20E4AC9813ED9D56F4262F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.Win32.dll
- Size 632KB
- SHA256 f7b8ef7fd57c4393d1828aaecda24c2dce8af7066c76f3a8aba3703c6ddbe718
- MD5 a7525e27f9aa1825811dc1f18e8c1d97
- SHA1 dda3369c6c21269ede6533aa1e13695ffbe89fb3
- SHA512 be117b8e3ee7bb5ddba0d37dd4946eb57f0b904f9ab9844941e0e6caa188449f3f3690a2827a3fff43a39332673d28d3dffe7dda58beea3d56284b2128dc97a5
- SSDEEP 12288:zno2sufIUpiK9pvxUJG09e1kpDtj0HM6j:pssiMYJG09e1ktCF
- TLSH
  T181D43B9533F00D83D4AF033662B21629C7B0E449D65BE78B5A9985BD2DE3710BE923F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.X11.dll
- Size 300KB
- SHA256 cecea533f3d74e00a1444a3dcd50b7c94ec157281374cc403d4f6e86ae876f7b
- MD5 a94bdadbac59548216d9e9599a42739d
- SHA1 4304102318141cfbc9cbee1c6c8a0dc9db29ce37
- SHA512 77e4130ba04610234262e42a8c7f7691a5372e1c9c66808a8bda207819b04e29f538a8b00fef2024d46b2cc9dbbbd65fc626d94bbda3e658d996ec6b34424030
- SSDEEP 6144:hVccJ/9ce9LJWZYFUrAKQW6GZl5FRVB/8uDFWvqCl9g3V/m:hVcW9LJWZYUAKQWfZl5HVZl4qzV/
- TLSH
  T188646C6D7BA40E23D43B953BE452582A8372E4869673E70EDE48E97A1CD37C05E107B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Avalonia.dll
- Size 4KB
- SHA256 505b75da3b4b70ddab1d314dc08dbbfa677f7c51a699ac6d79d63a45e9a3bf09
- MD5 97543bfd3f3b0e06a874e2cc00dfe4b9
- SHA1 50171013afab32cf16f4ca17fdc4b034137c571f
- SHA512 3cb52ce91fc3d4a167e4c81b17a1846dd7b9379903758b188fc9f0f16b10b2a4fe8f7dfabc7ce56b5ffec803aa79faa0064f7a70c624de4c91d864404d5a534b
- TLSH
  T1D78197528BF40336FCFB4B73ADB356425270FC60ED729B2F0C9622525C166244E72722
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/CompositionScroll.dll
- Size 53KB
- SHA256 28ad2889c90686652992c9dcca949615413ade2500bd326344c55dc30c70bd0e
- MD5 841da889119bc0e7288e0cb85c869fb8
- SHA1 4191caacd5b82304edabd49cbeaf45ece3de0bde
- SHA512 b89c951fc45cf6c8c886368de78fbb8eb9d18e8970e60f71c095e5a61a822d487a7ce55a5555a0d24890f9f891351069040242430d1bd267852cdc311ca8eb8d
- SSDEEP 1536:vjyo9iqks0Vyqe04QYzxnVKVr2C+Jk66DE7:LUqwWQY/kQ
- TLSH
  T17C334A51629D8A33DACF4BBEF8501401577A81377652F7C8AAC8B0FA09D3BE109563E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/CompositionScroll.pdb
- Size 27KB
- SHA256 251550fe44f4e3077e89a6e7b0bdd3a8396566a02faab4df8474d951aa9641e3
- MD5 19316246ce46f310f665946abf20cae4
- SHA1 0ac198c95f7d84c2684ab566acc88af6ac8dd0fd
- SHA512 9aa0ff059fec2d51b40ef57de2458d2c56e61de53188f83cfac44b46d42253bc5d0a70809c23fd8a3f984ec20205f53e09dc37cfa639d0788fd22af161234bc7
- SSDEEP 384:hDeK3QO+uzRyHb967NdpMhaAsAYZ1PK1hP0hHUcBZHF/f3u/ZiRy7C/kaFyPTsd0:hDTgIzRy796DDhHZqlwISlKOAIro3
- TLSH
  T17CC2E6639398D364C5426532A623C3982738C311AB4ADF76F2C8B365EDDFB5406F7268
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/DynamicData.dll
- Size 723KB
- SHA256 321f1d2a049323100db943f4664bf5a891af8040bae14a0e724f420ac2f530bd
- MD5 50458245d008a13428973cddccd90309
- SHA1 1cc98f4fbe97d6f438ee847365fc96b258aaa495
- SHA512 3c8588020e6daa9b22dcde8f50410538e1f1420bff5961b376753294ce1b0ca9de2ee951901c03e51c6df4ad87678bdd282c07694a7d2ae1e63efb18b579a501
- SSDEEP 12288:S5H7bb70wgN3WX3zXmfy/KzaOfqv3y2/WsKB0adasMH/zXueqgVO19wptmfH/Kd0:2bbCN3WXd/OfqaAIB0adasMHjueqgVOE
- TLSH
  T17BF42AA3B68DD325DA7FC6BBB526579807B1E421A047D7892ACDB0F04C423644C9CEBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Exodus Wallet.exe
- Size 14.9MB
- SHA256 3c6213c9f8e33c6d0f05d1ee44fa347406d93dcc6f153a6c710f0f8afd984a7f
- MD5 d10a5dc68e8382880e751881912d63b6
- SHA1 86f01fa4d4ab8d058ef880fe26e881171fdc85b2
- SHA512 6e1efae08a1a228236e4f9e5ec6c517ae1ff63722af826c700caf4cf61ac54726a689e7c08bd12c3698f06e8b63109d1e16238657c921507b0017874ca76484e
- SSDEEP 196608:WHuIDp1ulc+yha51NmhQdxbeNveKuq0idyDJorSBJRMpsoKvSHEPgb+FJlEOSSzd:4mS+HPmhqhKD05t1Cigb4bSShKENP
- TLSH
  T153F63307BFB48EA8C0A5BC399DE28727F775B9190A4245032F511DB39E33994FB62742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence pyinstaller
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral25
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Exodus.deps.json
- Size 25KB
- SHA256 b3522910442ab597e70effc9a400857b00612127e2c7f0c27856de5db4198500
- MD5 3422a9adc3e2966f1cc4608732cd2e2d
- SHA1 a5a2c12880f111f73fad7665be5f6da31cbf12cf
- SHA512 f784b1e4246650ccc0f519e7df24ed70c4cbb1c2a934298b60c9356eb692ade91451d0c8786c7ac18a99408d12c7b9c17236a34b5148a82bb64ee45d4ddc3ab1
- SSDEEP 192:1BpAjTO80iJ9CEu6V8RIUgz69ZwynmQWPjdPaZO:n2G80iJ9CEu6V8RIUgziZMpPjdCk
- TLSH
  T1BAC28967D9608D671DB66BA275360282F225036F60009A8F78FC749DCF77E2B2185F36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Exodus.dll
- Size 3.9MB
- SHA256 9f35fa8d3f628a2446c8c48c75137a22156b99210f302c3ede01da4990c10df9
- MD5 3016109e62c4c6c7630360f338e2d1cc
- SHA1 a815aeb8834dd708fc7febaaf055c07919a6f0eb
- SHA512 f9e84cf2aee2593c497a1312da7802cfefe7d620658313784bc3b879b25850ad1857e92c716388a69278355c1ef40c8cd110e65d03e19c6b2383f8bd59e3c304
- SSDEEP 98304:vumzWNQXiLBzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8NAvKBUuYN2YhPHd:vumCNQXiU2YVHd
- TLSH
  T1F4168C03EF53DF18C169BE7868FC837A6B71D4286D4A81033D962F3289A5990FD51B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Exodus.exe
- Size 507KB
- SHA256 849c0420722c1dabb927ff0ab70375bc1197ba73a7f04885460b609392bd319c
- MD5 470ccdab5d7da8aafc11490e4c71e612
- SHA1 bc540c0ba7dcb0405a7b6c775f0a1b585d51c4b3
- SHA512 6b3a09b785c02a57f6330cd6610f8a78b1f6a1689c14a190a9af4ad4ab4666f8a77d75c4c85a3af04693effdc970440ce8d62a4132f66471aaa250f9d90f2f7b
- SSDEEP 6144:lXWJ5kICW3Jyn4if1VZJiOeIdtuE5dqkBfybo:lmJWW3Jyn4KqkBfy
- TLSH
  T189B4E8173FB8D998C11CBD3A69F28727B7329A250F5605026F122E739A72DA8FF51344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Exodus.pdb
- Size 57KB
- SHA256 f50040a5f9c9d0667b2b022f6ac0142a8661670d8151d9506a9c696c495a7a18
- MD5 bb8b222eab589a3d1b619e5c78975990
- SHA1 bd2a697d3984209e7d5b717e9f09307a38ba0976
- SHA512 f7149c4f4b72c52d481e62163bcf8af8ba1ebecf93c8b63a718f153c42eae9758fd0df036382911bc0499cc1449a11c95c553d63242448472cff5e586a8bfa17
- SSDEEP 1536:Ln0cacn5YdldHRMU4GdOBiLUhobBo51L29mFi/Z7d:70/cqhld2iIkS5l7i/Z7d
- TLSH
  T1C243F99EF7548661C6A617BE40E7C38EB330C2159706BF3A72E4F471FC9A7109E26258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/Exodus.runtimeconfig.json
- Size 535B
- SHA256 7ac665c01a63e29d04f6c0e1ea7ab00d5ecb7d446edaa00b5ff92ed25bbc02c7
- MD5 9caa260e888fd08ba368b6053283fab4
- SHA1 98926cde266afce838ccd79fac1a1e85e5ce3ab0
- SHA512 295d414b8528497e9b96a1beb9e4985d97230c314680b0a46674d82baaba55663c6e8e03e5bdba883f52f670ccc8354b5a60d059371fa84fe00d1217fa6fe914
- TLSH
  T194F02769DA517CB314BA76BBD936C582EF30932B00002D56B5FD140C6FBBAA61222F55
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution
behavioral30
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/HarfBuzzSharp.dll
- Size 114KB
- SHA256 43865d1aafa39c8b8fba7d95a09f9c3ec07b87d8cd86b1b1eabe331649d271af
- MD5 eab587a98ba6bc681ec0a26f4bd7387f
- SHA1 4b8483a20337049ce731d188702651d6a064d06e
- SHA512 33f352b7558c2d36d7a322dfc88d5039ae953a796fcf6905a7cb02e18e806b9ef6bdafd13487f4ca4d423e92379ef636238c102833595016039b15d21cf4b47f
- SSDEEP 1536:C7apjMbuurV6308Q9JKWxxwgjZhRkVXyqSB/FTVsHzDzhEphgRmD+jKeMC3+am81:CwWJX7MsowVsHzDB8C3+o588
- TLSH
  T187B34B54CB984613EBEF5B3DF0365A420270E284B823FB9B27D6D1BCA893750D6D6253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  exodus larp HQ/exodus larp HQ/exodus larp HQ/net7.0-windows/MicroCom.Runtime.dll
- Size 14KB
- SHA256 59839e18e46b06ab23b633944ae3c3b552a300c5da389da870dfa980bcef93c1
- MD5 c27b01d179ab856b42e910496fe749f9
- SHA1 448412817480d6e20ae7eb2ff9250c69ed4ebece
- SHA512 30416fd4bf5554e6b575aff59787ae1078bafa529c36cbe51b05026691851a0824ab648d4d4d2ca4bd26ddab680eba95595e9cd80ee63230abffce799b36dabe
- SSDEEP 384:q5NX9uRskVFcxaQakfIut5vspHczY4DtcW8GsW:SX9uOIFAxtiHOh
- TLSH
  T1D7523B076B8CC237CBEF077E58F202864776E6047812EF0B34C8715A9D57F8956627A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32