Malware

Exodus

Also known asExodus OneExodus Two

Exodus is a modular surveillance malware family with Android components commonly designated Exodus One and Exodus Two, as well as reported Windows artifacts. On Android, Exodus One profiles newly infected devices by querying the IMEI and telephone number and checks in to command-and-control infrastructure via HTTP POST. Exodus Two performs extensive device surveillance and data collection, including address-book acquisition, call-log and SMS capture, enumeration of installed applications, collection of gallery metadata, browser bookmarks, and connected Wi-Fi passwords, and audio recording through the microphone and telephone calls. It can also capture images using device cameras. Reported Windows components provide file-management, SOCKS proxy, command-execution, scripting, browser-interaction, and VNC remote-control functionality, and use a deceptive installed-application identity. Android activity is consistent with spyware designed for persistent surveillance and data exfiltration.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1587.001MalwareEvidence1

MITRE ATT&CK techniques ... Resource Development Develop Capabilities: Malware T1587.001 Fake Trezor Suite, Ledger Live, and Exodus applications were built on the server.

T1608.001Upload MalwareEvidence1

MITRE ATT&CK techniques ... Resource Development Stage Capabilities: Upload Malware T1608.001 Malware was built and staged on an open-directory server.

Execution

1 technique

T1204.002Malicious FileEvidence1

MITRE ATT&CK techniques ... Initial Access User Execution: Malicious File T1204.002 User manually installed the fake wallet application and bypassed Gatekeeper.

Persistence

1 technique

T1543.001Launch AgentEvidence1

MITRE ATT&CK techniques ... Persistence Create or Modify System Process: Launch Agent T1543.001 com.trezormovement.agent was written at runtime; io.trezor.agent was bundled with the application.

Privilege Escalation

1 technique

T1543.001Launch AgentEvidence1

MITRE ATT&CK techniques ... Persistence Create or Modify System Process: Launch Agent T1543.001 com.trezormovement.agent was written at runtime; io.trezor.agent was bundled with the application.

Stealth

2 techniques

T1036MasqueradingEvidence1

MITRE ATT&CK techniques ... Defense Evasion Masquerading T1036 Malware impersonated Trezor Suite, Ledger Live, and Exodus. The fake Trezor application used com.electron.trezor-suite version 1.0.0.

T1036.005Match Legitimate Resource Name or LocationEvidence1

MITRE ATT&CK techniques ... Defense Evasion Masquerading: Match Legitimate Name or Location T1036.005 Application names, icons, and bundle identifiers matched legitimate software.

Credential Access

2 techniques

T1056.003Web Portal CaptureEvidence1

MITRE ATT&CK techniques ... Collection Input Capture: Web Portal Capture T1056.003 A fake seed-entry form collected 12-, 18-, 20-, or 24-word BIP39 recovery phrases and passphrases.

T1552.001Credentials In FilesEvidence1

Credential Access Unsecured Credentials: Credentials in Files T1552.001 Desktop wallet file enumeration

Discovery

1 technique

T1082System Information DiscoveryEvidence1

AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.

Collection

2 techniques

T1005Data from Local SystemEvidence3

Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.

T1056.003Web Portal CaptureEvidence1

MITRE ATT&CK techniques ... Collection Input Capture: Web Portal Capture T1056.003 A fake seed-entry form collected 12-, 18-, 20-, or 24-word BIP39 recovery phrases and passphrases.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence2

AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.

T1105Ingress Tool TransferEvidence1

the C2 provides three separate stealer modules that are available to download from the C2

Impact

1 technique

T1657Financial TheftEvidence1

MITRE ATT&CK techniques ... Impact Financial Theft T1657 A stolen BIP39 recovery seed provides full access to the victim’s cryptocurrency wallet.

INDICATORS OF COMPROMISE

IOCs tracked for this family

54 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

46 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

hash.sha256●●●●●●●●●●●●View more in app1 month ago

domain●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

22 SOURCESView more in app

cryptika blogNews

Sep 2, 2026

Hackers Hide a Full Remote Access Trojan Inside a Real Exodus Crypto Wallet | Cryptika Cybersecurity

A modular remote-access backdoor/spyware implant. The listed modules indicate capabilities for file management, SOCKS proxying, command execution, scripting, browser interaction, and VNC-based remote desktop access.

mitre attack websiteNews

Oct 21, 2021

Capture Camera, Technique T1512 - Mobile | MITRE ATT&CK®

Android malware variant capable of taking pictures with device cameras.

mitre attack websiteNews

Oct 21, 2021

Application Discovery, Technique T1418 - Mobile | MITRE ATT&CK®

Android spyware capable of obtaining a list of installed applications.

mitre attack websiteNews

Oct 21, 2021

Capture SMS Messages, Technique T1412 - Mobile | MITRE ATT&CK®

Mobile spyware family whose Exodus Two variant can capture SMS messages.

+18 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching54

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Exodus

Also known asExodus OneExodus Two