Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Malicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS Proxies
Excerpt
A malicious installer disguised as the Exodus cryptocurrency wallet is being used to deploy a modular remote-access trojan (RAT) that steals browser data, enables hidden remote control, and converts infected Windows computers into SOCKS proxy relays . Researchers observed four unrelated organizations compromised between late July and mid-August 2026. Three incidents occurred within 85 minutes on August 18, using an installer created only one day earlier. The campaign delivers…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 7bac804d911f45eda362d3fe189c6833 | Medium | Score 53/100 | First seen |
| Domain | us05.org | High | Score 58/100 | First seen |
| SHA256 | c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485 | Medium | Score 53/100 | First seen |
| MD5 | 3eb6f92aedf74f109c7b4b0897ec39a8 | High | Score 81/100 | First seen |
| MD5 | 4c604435e1f2489fad4f0ecc506c9f10 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…