Exodus

MITRE ATT&CK: S0405 View on attack.mitre.org

Aliases: Exodus One, Exodus Two, Exodus

First seen
2019-03-01 00:00:00
Malware type
spyware, dropper
Family
Malware family
Operating systems
android
Related IoCs
2 (2 malicious)
Last IoC activity
2026-07-07 18:26:23
Profile updated
2026-07-07 13:47:50

Targeted industries: government-and-public-sector

Targeted regions: country_code:it

Context

Exodus is Android spyware deployed in two distinct stages named Exodus One (dropper) and Exodus Two (payload).

Recent IoC activity

2 malicious indicators in Maltiverse are attributed to Exodus (S0405). The 2 most recently updated:

TypeIndicatorUpdatedSources
file sample exodus_sample3.apk 2026-07-07 2
file sample 8453ce501fee1ca8a321f16b09969c517f92a24b058ac5b54549eabd58bf1884 2026-07-05 2

Malware & tools used

  • Calendar Entries (attack-pattern)
  • Archive Collected Data (attack-pattern)
  • Stored Application Data (attack-pattern)
  • Internet Connection Discovery (attack-pattern)
  • Exploitation for Privilege Escalation (attack-pattern)
  • Web Protocols (attack-pattern)
  • Contact List (attack-pattern)
  • Video Capture (attack-pattern)
  • Download New Code at Runtime (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Audio Capture (attack-pattern)
  • SMS Messages (attack-pattern)
  • Non-Standard Port (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Location Tracking (attack-pattern)
  • Call Log (attack-pattern)
  • Data from Local System (attack-pattern)
  • Screen Capture (attack-pattern)
  • Software Discovery (attack-pattern)

Reports & references

  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • malpedia.caad.fkie.fraunhofer.de — Apk.Exodus (report)
  • securitywithoutborders.org — Exodus (report)
  • motherboard.vice.com — Hackers Hid Android Malware In Google Play Store Exodus Esurv (report)
  • motherboard.vice.com — Prosecutors Investigation Esurv Exodus Malware On Google Play Store (report)
  • MITRE ATT&CK — S0405 (report)
  • web.archive.org — Exodus (report)

External references