5cacbae4473ff0d0ee772ca315841105ad5b0b67b8bb32afc47e3d4219a2ef6d

Sharing

Copy URL Twitter E-mail

General

Target
Exodus-Larp-Tool-main.zip
Size 523KB
Sample261102-esae8aea73
SHA256 5cacbae4473ff0d0ee772ca315841105ad5b0b67b8bb32afc47e3d4219a2ef6d
MD5 b5ab41fb5272aa4a7af4050df5aad73d
SHA1 f4015e8cf77d6830fd9e1e11cb05e5a72cedcb61
SHA512 72d2e56408b2cffd168f7db12c6596a725f743382362c0934d6d2daf88e202eed16b06cabc7568fa80a1119163376d76c1c0a8884bd8a31bcf3846a0096d0382
SSDEEP 12288:OXBXWsi9J1PJ8mX8zk0yPuUvEOLsdZp3rD4IT4YjyQ:OXBXWJD8wz8mM3PvTEQ
TLSH
T109B423EBC155D582E30ED7BF9569394CC2C1CFF29B172EB90787A91A152C342186A3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Exodus-Larp-Tool-main/Exodus.exe
- Size 399KB
- SHA256 6c977cac10245be0d1222fa444aafeed327e840a8864c7a37feb401ed51e7257
- MD5 ba5da443c5e881df3147e9c110240df3
- SHA1 4841a82719a2ef2092752ccf107dcc021a59134c
- SHA512 86d167aaa77b2ecf0b624e8c37b48073b98126aa05e9af949e362b5025f8a81210082810c169ea9a9a2987c3e8052e1110dd2a5f6b7c54e67161338e013e9c94
- SSDEEP 3072:VBRO3hCKpIdtHO1qeGAhY5dqkBfyboS0lYi5iNMfYT:nReIdtuE5dqkBfyboo
- TLSH
  T14A9495273FB9DE48C21CBD7A69F18737B7318A250D4A05117E122E73D672DA8FB81684
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery credential_access defense_evasion execution persistence privilege_escalation spyware stealer trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  Exodus-Larp-Tool-main/HarfBuzzSharp.dll
- Size 114KB
- SHA256 43865d1aafa39c8b8fba7d95a09f9c3ec07b87d8cd86b1b1eabe331649d271af
- MD5 eab587a98ba6bc681ec0a26f4bd7387f
- SHA1 4b8483a20337049ce731d188702651d6a064d06e
- SHA512 33f352b7558c2d36d7a322dfc88d5039ae953a796fcf6905a7cb02e18e806b9ef6bdafd13487f4ca4d423e92379ef636238c102833595016039b15d21cf4b47f
- SSDEEP 1536:C7apjMbuurV6308Q9JKWxxwgjZhRkVXyqSB/FTVsHzDzhEphgRmD+jKeMC3+am81:CwWJX7MsowVsHzDB8C3+o588
- TLSH
  T187B34B54CB984613EBEF5B3DF0365A420270E284B823FB9B27D6D1BCA893750D6D6253
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Exodus-Larp-Tool-main/MicroCom.Runtime.dll
- Size 14KB
- SHA256 59839e18e46b06ab23b633944ae3c3b552a300c5da389da870dfa980bcef93c1
- MD5 c27b01d179ab856b42e910496fe749f9
- SHA1 448412817480d6e20ae7eb2ff9250c69ed4ebece
- SHA512 30416fd4bf5554e6b575aff59787ae1078bafa529c36cbe51b05026691851a0824ab648d4d4d2ca4bd26ddab680eba95595e9cd80ee63230abffce799b36dabe
- SSDEEP 384:q5NX9uRskVFcxaQakfIut5vspHczY4DtcW8GsW:SX9uOIFAxtiHOh
- TLSH
  T1D7523B076B8CC237CBEF077E58F202864776E6047812EF0B34C8715A9D57F8956627A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.CSharp.Scripting.dll
- Size 30KB
- SHA256 eb5185d1b4424bc2538c8dbb3311b787f8efa153d68885e82ec199aa5a6b90de
- MD5 b134242e74090be398630d825939429f
- SHA1 01fa962abf9e1879f6342c4aca01855b68edcbb3
- SHA512 089cda457451ea5ca68ea3d7a53c8eda44d7be5fcefc4f26b825ce34239a0b5b7a7733140d5c7c01e3346de9bce25308aa2363c0314028cce83e98f85d33aed1
- SSDEEP 384:TLPzuYYMWBAy475WGY0c8oDIXxfYlcibnlIhWkB2fWPudHRN7p/hl30HGF:TLSYYMHtW8oDIBfYjMUxEc
- TLSH
  T1C6E24C859B58C247EEEB5A32756EF5127F39F3C259C19628391CE98C0B13BD14F01B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.Scripting.dll
- Size 133KB
- SHA256 14afc4797218a849c71e88760de14d5aa4eb25ea0f8ce0c6cac693bac681b539
- MD5 f8485604c7af6a2fd52a49db2cbd6629
- SHA1 97da81e26b3a452d4adf61ff30f69cea2133789a
- SHA512 a9bbfb2aad60152368a6851479267b2ae90cb9e81f553c93af2346f50e1c48470a7a5e8983dde7ba7806965a69a4586c7288f90fd9b3db104f83a29baab5c435
- SSDEEP 3072:BJ/hR4eioGli3hytmLLU+hW4VrCD1JYXLCUMF9G:DEe5GM3hFsvErCDrKuJF
- TLSH
  T16FD37C1063A8535BDADF5E76F5B8A0014B7AF303E482E78D9C487DEE18137A05E22677
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Exodus-Larp-Tool-main/Newtonsoft.Json.dll
- Size 695KB
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH
  T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12