Two OTX pulses published 2026-09-02 paint a converging picture of the credential- and cryptocurrency-theft ecosystem: a legacy botnet disrupted at the infrastructure layer, and a modern, modular intrusion kit abusing trusted software branding to reach enterprise endpoints.
Pulse 1 — Sality P2P Sinkhole Operation. On August 31, 2026, a joint law-enforcement action (United States, Bulgaria, Hungary, Romania) supported by CrowdStrike and the Shadowserver Foundation disrupted the Sality botnet — a peer-to-peer botnet active since 2003. Sality infects Windows executables (file-infector behavior) and historically serves as a distribution backbone for spam, DDoS, credential theft, and clipper payloads. The takedown used peer-list manipulation: defenders poisoned Sality's own P2P overlay so infected nodes received sinkhole addresses instead of live peers, severing the delivery path for new payloads — most notably the EggJagger clipper, which hijacks clipboard cryptocurrency addresses to reroute wallet transfers to attacker-controlled wallets. Important nuance for SOC teams: the sinkhole cuts new payload delivery, but infected hosts remain infected and will beacon toward sinkhole infrastructure — those connections are free, high-fidelity detection signals.
Pulse 2 — Tampered Exodus Installer Modular RAT. Between late July and mid-August 2026, multiple organizations were compromised by a modular RAT masquerading as an Exodus cryptocurrency wallet. The lure chain: fake PDFs or bogus software-update prompts deliver a JavaScript dropper, which pulls a tampered Windows Installer (MSI) package. The MSI installs the genuine Exodus wallet v24.33.4 — but with three modified files — meaning victims see a working wallet while the implant stages in the background. Post-install, modular DLLs provide a full intrusion toolkit: dll4_cmd (remote command execution), dll4_fileman (file management/exfil), dll4_browser (browser credential and session theft), dll4_socks (SOCKS proxy for attacker traffic relay), and dll4_vnc (remote desktop/VNC access), with dll4_script handling script execution. C2 configuration and tasking leverage Azure Table Storage, blending command traffic into legitimate Microsoft cloud services.
Collectively, the objective is financial: cryptocurrency theft at the point of transaction (clippers) and full-spectrum credential harvesting and session hijack (modular RAT) with monetization of access via SOCKS proxy resale and wallet draining.
Threat Actor / Malware Profile
Sality (Legacy File-Infecting P2P Botnet)
- Distribution: File infection of Windows executables, removable/network drive propagation; acts as a downloader for secondary payloads.
- Payload behavior: Delivers spam modules, DDoS bots, credential stealers, and the EggJagger clipper, which monitors the clipboard for cryptocurrency wallet address patterns and substitutes attacker addresses in real time.
- C2 communication: Decentralized P2P overlay — no static C2 to block. Peers exchange signed URL/peer lists; the takedown exploited this by injecting sinkhole peers into the overlay. Historical delivery domains in the pulse (e.g.,
pozdravizbeograda.com,forex2030.com,www.yonelco.com,theunforgiven.p8.hu,gatheredovertime.com,imagebucket.biz) hosted payload resources (readme.pdf,icon.png,top.gif,/nb4,/nv4) — characteristic of disposable malware staging hosts. - Persistence: Infection of legitimate executables ensures re-execution whenever a host binary runs; registry run keys historically supplement this.
- Anti-analysis: Long-lived polymorphic code, P2P resilience (no single point of failure — which is precisely why the takedown required overlay poisoning rather than domain seizure).
Tampered Exodus Installer RAT (dll4_* module family)
- Distribution: Social engineering via fake PDFs and fake software-update prompts → JavaScript dropper → tampered MSI installer.
- Payload behavior: Side-loads a trojanized build alongside genuine Exodus v24.33.4 (three modified files). Modular capability set delivered on demand: shell access (
dll4_cmd), file theft (dll4_fileman), browser credential/cookie theft (dll4_browser), traffic relay (dll4_socks), interactive control (dll4_vnc), and scripting (dll4_script). - C2 communication: Azure Table Storage abused as a dead-drop/tasking channel — outbound traffic targets legitimate Azure endpoints, defeating simple domain blocklists and reputation filtering.
- Persistence: Installer-level tampering embedded in a trusted application; MSI-based install provides a natural persistence footprint via installed product registration.
- Anti-analysis: Valid, functional decoy application; modular on-demand payload retrieval limits on-disk footprint; cloud-sanctioned C2 channel.
IOC Analysis
The pulse indicator sets split into two operational classes:
Network indicators (Sality pulse): domains and URLs such as pozdravizbeograda.com, forex2030.com, www.yonelco.com, gatheredovertime.com, imagebucket.biz, theunforgiven.p8.hu and paths /readme.pdf, /icon.png, /top.gif, /nb4, /nv4. These are historical payload-staging infrastructure. Block at DNS/web proxy, but also hunt retrospectively — any host resolving these between 2026-07-01 and 2026-08-31 was part of the Sality delivery chain. Post-sinkhole, outbound connections toward sinkhole infrastructure from your estate indicate still-infected endpoints; treat these as confirmed-compromised hosts.
File hash indicators (Exodus RAT pulse): seven SHA-256 values covering the tampered installer, JS dropper, and dll4_* modules (e.g., 2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d, 84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756, c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485, and the full set of 47 in the pulse). The domain us05.org is associated infrastructure.
Operationalization:
- Push SHA-256 sets to EDR blocklists (Defender, CrowdStrike, SentinelOne custom IOC feeds) — hash IOCs for modular DLLs remain high-value because modules are fetched on demand and may appear days after initial compromise.
- Feed domains/URLs into DNS filtering and proxy block rules; alert — don't just sinkhole — so SOC sees the attempted callback.
- Grep firewall/proxy logs for Azure Table Storage endpoints (
*.table.core.windows.net) from endpoints that have no business reason to use Azure Storage — this is the highest-signal behavioral proxy for the Exodus RAT's C2. - Enrich with OTX pulse context (tags, references) in your TIP so analysts triaging a hit see the campaign narrative, not a bare hash.
Detection Engineering
---
title: Tampered Exodus Wallet Installer - Modular RAT DLL Load
description: Detects loading of dll4_* modular RAT components associated with the trojanized Exodus wallet installer campaign (OTX 2026-09-02). Modules include dll4_cmd, dll4_fileman, dll4_browser, dll4_socks, dll4_vnc, dll4_script.
author: Security Arsenal Threat Intel
logsource:
category: image_load
product: windows
detection:
selection_img:
ImageLoaded|contains:
- '\dll4_cmd'
- '\dll4_fileman'
- '\dll4_browser'
- '\dll4_socks'
- '\dll4_vnc'
- '\dll4_script'
filter_exodus_path:
ImageLoaded|startswith:
- 'C:\Program Files\Exodus\'
- 'C:\Program Files (x86)\Exodus\'
condition: selection_img and not filter_exodus_path
falsepositives:
- Legitimate Exodus updates installing components in the official install directory (filtered); verify any non-standard paths
level: high
status: experimental
tags:
- attack.execution
- attack.defense_evasion
- attack.t1218
- attack.t1059
---
title: JavaScript Dropper Spawning MSI Installer - Fake Software Update Pattern
description: Detects wscript/cscript executing JavaScript that subsequently launches msiexec, matching the Exodus RAT delivery chain (fake PDF/update lure -> JS dropper -> tampered MSI).
author: Security Arsenal Threat Intel
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
selection_child:
Image|endswith: '\msiexec.exe'
condition: selection_parent and selection_child
falsepositives:
- Enterprise software distribution scripts; baseline known-good deployment tooling
level: high
status: experimental
tags:
- attack.execution
- attack.t1059.007
- attack.t1218.005
---
title: Suspicious Outbound to Azure Table Storage From Non-Cloud Workload
description: Detects processes with no expected Azure Storage use initiating connections to Azure Table Storage endpoints, consistent with the Exodus RAT's cloud dead-drop C2 channel.
author: Security Arsenal Threat Intel
logsource:
category: network_connection
product: windows
detection:
selection_dest:
DestinationHostname|endswith: '.table.core.windows.net'
selection_proc:
Image|endswith:
- '\Exodus.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\powershell.exe'
condition: selection_dest and selection_proc
falsepositives:
- Legitimate applications using Azure Storage SDK; validate against approved application inventory
level: medium
status: experimental
tags:
- attack.command_and_control
- attack.t1102
- attack.t1071.001
// Hunt: Exodus RAT IOCs + Sality staging infrastructure (OTX 2026-09-02)
let exodusHashes = dynamic([
"2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d",
"5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603",
"5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a",
"7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8",
"84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756",
"8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a",
"c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485"]);
let salityDomains = dynamic([
"pozdravizbeograda.com","forex2030.com","yonelco.com",
"theunforgiven.p8.hu","gatheredovertime.com","imagebucket.biz","us05.org"]);
let lookback = 60d;
union isfuzzy=true
(DeviceFileEvents
| where TimeGenerated > ago(lookback)
| where SHA256 in (exodusHashes)
| project Signal="Known Exodus RAT hash", TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName),
(DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any (salityDomains)
| project Signal="Sality/Exodus infra contact", TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl endswith ".table.core.windows.net"
| where InitiatingProcessFileName in~ ("Exodus.exe","rundll32.exe","regsvr32.exe","wscript.exe","cscript.exe")
| project Signal="Suspicious Azure Table Storage C2", TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ ("wscript.exe","cscript.exe","mshta.exe")
| where FileName =~ "msiexec.exe"
| project Signal="JS dropper spawned MSI install", TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName)
| order by TimeGenerated desc
# Security Arsenal IOC Hunt — Sality / Tampered Exodus RAT (OTX 2026-09-02)
# Run elevated on endpoints or deploy fleet-wide via your RMM/EDR script engine.
$ExodusHashes = @(
"2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d",
"5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603",
"5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a",
"7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8",
"84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756",
"8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a",
"c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485"
)
$findings = @()
# 1. Exodus install presence + module DLL artifacts
Write-Host "[*] Checking for Exodus installations and dll4_* module artifacts..." -ForegroundColor Cyan
$exodusPaths = @("$env:ProgramFiles\Exodus", "${env:ProgramFiles(x86)}\Exodus", "$env:LOCALAPPDATA\exodus", "$env:APPDATA\Exodus")
foreach ($p in $exodusPaths) {
if (Test-Path $p) {
Write-Host "[!] Exodus install found: $p — hash all binaries against IOC set" -ForegroundColor Yellow
$findings += "EXODUS_INSTALL: $p"
Get-ChildItem $p -Recurse -Include *.dll,*.exe -ErrorAction SilentlyContinue | ForEach-Object {
$h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
if ($h -and ($ExodusHashes -contains $h.ToLower())) {
$findings += "CONFIRMED_IOC_HASH: $($_.FullName) [$h]"
}
}
}
}
Get-ChildItem -Path "$env:ProgramData","$env:TEMP","$env:APPDATA" -Recurse -ErrorAction SilentlyContinue -Include "dll4_*.dll" | ForEach-Object {
$findings += "MODULE_DLL: $($_.FullName)"
}
# 2. Run-key persistence (Sality + generic stealer persistence)
Write-Host "[*] Auditing Run keys for suspicious entries..." -ForegroundColor Cyan
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
Get-ItemProperty $rk -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
$v = (Get-ItemProperty $rk -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
if ($v -match "temp|appdata|\.js|wscript|mshta") { $findings += "RUNKEY: $rk\$($_.Name) = $v" }
}
}
# 3. Scheduled tasks referencing scripts/MSI staging
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
($_.Actions.Execute -match "wscript|cscript|mshta|msiexec") -and $_.TaskPath -notmatch "Microsoft"
} | ForEach-Object { $findings += "SUS_TASK: $($_.TaskPath)$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }
# 4. Active connections to Azure Table Storage or Sality staging IPs
Write-Host "[*] Checking active network connections..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
try {
$dns = ([System.Net.Dns]::GetHostAddresses($_.RemoteAddress) | Out-Null; (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost)
} catch { $dns = "" }
if ($dns -match "table.core.windows.net|pozdravizbeograda|forex2030|yonelco|us05.org|gatheredovertime|imagebucket") {
$findings += "NET_CONN: $($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort) [$dns]"
}
}
Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Green
if ($findings.Count -eq 0) { Write-Host "No indicators found on this host." }
else { $findings | ForEach-Object { Write-Host $_ -ForegroundColor Red } }
$findings | Out-File "$env:TEMP\arsenal_ioc_hunt_$(Get-Date -Format yyyyMMdd_HHmmss).txt"
Response Priorities
Immediate (0–4 hours)
- Block all Sality staging domains/URLs (
pozdravizbeograda.com,forex2030.com,yonelco.com,theunforgiven.p8.hu,gatheredovertime.com,imagebucket.biz,us05.org) at DNS and proxy layers — with alerting, not silent drops. - Push the seven SHA-256 Exodus RAT hashes into EDR prevention lists; run the KQL and PowerShell hunts fleet-wide.
- Inventory every host with Exodus wallet installed — crypto wallets on corporate endpoints are themselves a policy violation; validate the installer provenance of each instance against official Exodus signing.
- Any host observed contacting sinkhole infrastructure post-2026-08-31 is a confirmed Sality infection — isolate and reimage; file infectors defeat most remediation tooling.
24 hours
- Both pulses describe credential theft (Sality modules historically;
dll4_browseractively). For any host with a confirmed or suspected hit: force password resets for all accounts that authenticated from that machine, revoke active sessions/refresh tokens, and rotate any credentials stored in browsers on the endpoint. - Treat
dll4_browserexposure as session-token theft: invalidate OAuth tokens and cookies, not just passwords. Check IdP sign-in logs (Entra ID, Okta) for anomalous session reuse from unfamiliar IPs — thedll4_socksmodule means attacker traffic may egress from inside victim networks, so also flag impossible-travel-within-estate patterns. - Audit crypto transaction activity for users with wallet software; clipboard-substitution clippers (EggJagger) leave evidence in unsent/mismatched recipient addresses.
1 week
- Enforce application control (WDAC/AppLocker) blocking unsigned MSI execution and
wscript/cscript/mshtachild-process spawning of installers — this breaks the entire Exodus RAT delivery chain. - Restrict outbound access to Azure Table Storage endpoints (
*.table.core.windows.net) to approved application identities; cloud dead-drop C2 is only viable when the estate permits arbitrary SaaS egress. - Deploy DNS-level sinkhole visibility and formally prohibit consumer cryptocurrency wallet software on corporate endpoints via policy and technical enforcement.
- Subscribe SOC triage workflows to OTX pulses tagged
clipper,modular rat, andbotnet takedown— takedown events are detection opportunities, not just news.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.