General

  • Target
    Exodus-Larp-Tool-main.zip
  • Size 523KB
  • Sample260906-yqwefsda84
  • SHA256 1fae006d509e02ba5b71fd4a007f9b935f32656080ecd17b7213be264b8d0957
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      Exodus-Larp-Tool-main/Exodus.exe
    • Size 399KB
    • SHA256 6c977cac10245be0d1222fa444aafeed327e840a8864c7a37feb401ed51e7257
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

MITRE ATT&CK Enterprise v16

Tasks