Exodus Wallet Installer RAT

A trojanized Exodus cryptocurrency wallet installer delivers a genuine, working copy of Exodus Wallet 24.33.4 with three files modified so the wallet window never displays. Behind that silent wallet sits a JavaScript-based reflective PE loader that AES-256-CBC-decrypts a roughly 10 MB, six-module RAT entirely in memory: remote command execution, file management, browser credential and cookie theft, a SOCKS proxy, hidden VNC, and a Lua scripting engine. The attacker's objective is full interactive access and a pivot point, not just wallet contents: the module set (hidden VNC plus SOCKS plus a browser stealer) is a hands-on-keyboard toolkit wearing a crypto-wallet disguise.

Delivery uses two confirmed vectors, a .pdf.js double-extension file opened via Windows Script Host, and a JavaScript file staged inside a ZIP presented as a software update, plus one documented-but-unobserved search-ms: WebDAV redirect capability. Both confirmed chains show a real decoy PDF opening from a legitimate CDN while msiexec silently installs the ~210 MB MSI to %APPDATA%\ExdBackupTool\, a path no legitimate Exodus install ever uses. Persistence is two scheduled tasks registered through the Task Scheduler COM API (no schtasks.exe command line to catch): ExdBackupTool relaunches the wallet hourly, and INetHealth repeatedly blanks the user's proxy settings to keep command-and-control traffic direct. C2 itself is a dead-drop pattern against Azure Table Storage, blending into infrastructure that sits on nobody's blocklist.

The highest-value defensive angle is not the atomic indicators, which the operator's own tooling proves rotate every rebuild, but the structural behaviors that survive a rebuild: a per-user Electron wallet launched through explorer.exe from %APPDATA% instead of %LOCALAPPDATA%\exodus, an hourly svchost.exe-parented relaunch, and a scheduled task quietly re-clearing proxy configuration. Those four shapes are what this pack hunts hardest.

Defender priority: any host that shows the %APPDATA%\ExdBackupTool\Exodus.exe path, the ExodusHelper mutex, or the hourly svchost.exe-launched relaunch pattern should be treated as a full interactive compromise, not a malware infection. Hidden VNC and a SOCKS module mean an operator may have had hands-on-keyboard access; the browser module means saved credentials and session cookies must be treated as stolen, so revoke active sessions and rotate credentials rather than only resetting passwords.

Decisions and exclusions

• No prompt-injection attempts were found in any fetched source. All three pages returned straightforward technical reporting with no embedded instructions directed at an automated reader.
• Huntress explicitly lists 45 domains (pattern api./cdn./static./app./auth. prefixed on small-business domains) that were configured in the binary but never contacted during detonation, and cautions that the domain owners "may themselves be victims." None of those 45 domains are shipped as indicators in this pack; they are documented in the source snapshot only, as unconfirmed capability rather than confirmed infrastructure.
• Huntress explicitly instructs readers not to treat api.blockchain.info, api.moonpay.com, api.rampnetwork.com, api.segment.io, and www.googleapis.com as indicators, since those are genuine Exodus API endpoints sitting in the same region of the decrypted file. Excluded from this pack on the same basis.
• A social-media summary post (DFIR Radar on X) surfaced in search results but was not fetched or cited; its content is a paraphrase of the same Huntress writeup and adds no independently verifiable detail, so it is excluded rather than treated as a fourth source.
• Several additional syndication sites (Substack, cybersecuritynews.com, cryptika.com, hendryadrian.com, cyberpress's sister OffSeq radar page) appeared in search results and were not fetched; they were not needed once three independent fetches corroborated the atomic indicators used at prevent/critical severity.
• The dll4_browser.dll SHA-256 required correction against the raw source HTML: an early text-extraction pass dropped two characters from the hash. The value shipped in this pack (7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8) was re-verified directly against the raw <code> span in the Huntress page and is a full, valid 64-character SHA-256.

Hunt hypotheses

1. H1 (high): A user opens a .pdf.js double-extension file or a JavaScript file staged out of a ZIP, and Windows Script Host executes it as a child of chrome.exe or explorer.exe. Falcon telemetry: ProcessRollup2.
2. H2 (high): The dropper silently installs an unsigned, oversized MSI via msiexec /i ... /quiet /norestart from %TEMP%, using a two-letter-plus-four-digit filename convention. Falcon telemetry: ProcessRollup2.
3. H3 (high): The trojanized wallet runs from %APPDATA%\ExdBackupTool\Exodus.exe, launched through explorer.exe so the process tree looks like a manual double-click, instead of the legitimate %LOCALAPPDATA%\exodus path. Falcon telemetry: ProcessRollup2.
4. H4 (high): Persistence is registered as two scheduled tasks, ExdBackupTool and INetHealth, created via the Task Scheduler COM API rather than schtasks.exe. Falcon telemetry: ScheduledTaskRegistered.
5. H5 (high): Every hour, at roughly the same minute, svchost.exe relaunches Exodus.exe out of the trojanized path as the Task Scheduler fires. Falcon telemetry: ProcessRollup2.
6. H6 (medium): The INetHealth payload runs as a hidden-window PowerShell command (conhost.exe --headless parenting powershell.exe -e <base64>) that clears ProxyEnable, ProxyServer, and AutoConfigURL. Falcon telemetry: ProcessRollup2 plus RegGenericValueUpdate.
7. H7 (medium): The koffi FFI module the reflective loader depends on extracts a native .tmp.node module into %TEMP% at runtime. Falcon telemetry: PeFileWritten.
8. H8 (high): The RAT beacons to an Azure Table Storage dead drop (lgapistorage123.table.core.windows.net, secondarily winapi.table.core.windows.net) from the trojanized wallet process rather than a browser. Falcon telemetry: DnsRequest.

Attack chain

These checks are useful redundancy where Sysmon, Windows auditing, or PowerShell logging run alongside Falcon, or as a fallback where CQL coverage has a documented gap (Section 5).

Task Scheduler operational log

Microsoft-Windows-TaskScheduler/Operational, Event ID 106 (task registered). Filter TaskName for ExdBackupTool or INetHealth. This log captures COM-API task registration even when no schtasks.exe process ever runs, which is the exact gap the actor is exploiting.

PowerShell Script Block Logging

Windows Event ID 4104. Even with an -EncodedCommand base64 blob, script block logging records the decoded content, which will surface the literal InternetSetOption P/Invoke definition and the ProxyEnable/ProxyServer/AutoConfigURL registry writes that make up the INetHealth payload.

Registry auditing on Internet Settings

Windows Security Event ID 4657 (or 4663 with an object-access SACL configured) on HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, watching ProxyEnable, ProxyServer, and AutoConfigURL. Requires a SACL to be present; verify one is configured before relying on this as a detection source.

MSI installer event log

Application log, source MsiInstaller, Event IDs 1040/1042 (install start/end) and 11707 (success). Cross-reference the install directory captured in these events against %LOCALAPPDATA%\exodus; anything installing Exodus-branded content to %APPDATA% instead is the same signal as Q4, from a different log source.

Sysmon fallback (environments without full Falcon coverage)

Sysmon Event ID 1 (process create) reproduces Q1, Q2, Q4, Q6, and Q12 using Image, ParentImage, and CommandLine in place of the Falcon field names. Sysmon Event ID 11 (file create) reproduces Q9 for the .tmp.node koffi module.

Seven of the twelve hunt queries are strong Custom IOA candidates: stable behavioral patterns with low expected false-positive rates that do not depend on perishable atomic indicators.

Alert & triage package (representative: Q4, the highest-confidence detection)

Scheduled Search name: DETECT: Exodus Wallet Wrong Install Path (ExdBackupTool)

Scheduled Search description: Fires when Exodus.exe runs from %APPDATA%\ExdBackupTool\ instead of the genuine %LOCALAPPDATA%\exodus path. This path is exclusive to the trojanized installer; there is no legitimate reason for it to exist on a host.

Alert email subject: [CRITICAL] Detection: Exodus Wallet Installer RAT, trojanized wallet path observed

Alert email body: A host has executed Exodus.exe from %APPDATA%\ExdBackupTool\, the install path used exclusively by the trojanized Exodus wallet installer that hides a six-module remote access trojan (hidden VNC, SOCKS proxy, browser credential theft, file management, remote shell, and Lua scripting). Treat this host as a full interactive compromise, not a malware infection: the module set implies an operator may have had hands-on-keyboard access, and any credentials or session cookies in the affected user's browsers should be considered stolen. Immediate actions: network-isolate the host in Falcon, do not power off (preserve volatile memory for potential RAT-module analysis), and open an incident. Escalate to IR on confirmed hit; this query has no known false-positive path.

Triage checklist

1. Confirm the alerting process image path is exactly %APPDATA%\ExdBackupTool\Exodus.exe, not a legitimate Exodus path.
2. Pull the host's process tree for the prior 30 days; look for the Q1/Q2 delivery pattern (wscript.exe/cscript.exe with a .pdf.js or .zip.<n>\ commandline) as patient zero.
3. Check for the Q5 scheduled tasks (ExdBackupTool, INetHealth) and the Q6 hourly svchost relaunch pattern to establish persistence duration.
4. Check for Q10/Q11 network activity to confirm active C2 versus a stale, uncommunicating install.
5. Network-isolate the host in Falcon Console immediately; do not allow further C2 traffic.
6. Identify every browser profile on the host and treat all stored credentials, cookies, and autofill data as compromised.
7. Pull a full process listing and network-connection snapshot before remediation, in case hidden VNC or SOCKS activity needs later reconstruction.
8. Escalate to IR for scoping across other hosts using Q4 and Q6 environment-wide (see pivot queries below).

Pivot queries

Host-scoped, confirm persistence:

#event_simpleName=/^ScheduledTaskRegistered$/
aid = "<affected-aid>"
TaskName=/^(ExdBackupTool|INetHealth)$/i
| table([@timestamp, TaskName, TaskExecutable])

Environment-wide, scope the campaign:

#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
ImageFileName=/\\AppData\\Roaming\\ExdBackupTool\\Exodus\.exe$/i
| groupBy([aid, ComputerName], function=count(as=Hits), limit=1000)
| sort(Hits, order=desc)

Environment-wide, confirm active C2:

#event_simpleName=/^DnsRequest$/
DomainName=/^(lgapistorage123|winapi)\.table\.core\.windows\.net$/i
| groupBy([aid, ComputerName], function=[count(as=Hits), selectFromMax(field=@timestamp, include=[DomainName])], limit=1000)

Investigate-only queries (Q2, Q7, Q8, Q9, Q11)

These stay as hunt/investigate queries rather than IOA candidates: Q2 and Q7 rely on patterns with legitimate-use overlap (ZIP-staged scripts, conhost --headless), Q8 overlaps with routine GPO/SCCM proxy management, Q9's .tmp.node pattern is a pivot signal shared with other Electron/FFI software, and Q11's atomic indicators are explicitly confirmed short-lived by the source. Run these on a schedule and hand hits to an analyst for correlation rather than auto-alerting.

type,value,action,severity,expiration,description,tags
sha256,c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485,prevent,critical,2027-03-15,Trojanized Exodus Backup Tool MSI installer (jn0101.msi / jg0384.msi label variants); corroborated by 3 independent sources,campaign:ExodusWalletRAT
sha256,8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a,prevent,critical,2027-03-15,Decrypted modular RAT payload; memory-resident; corroborated by 2 independent sources,campaign:ExodusWalletRAT
sha256,fdd376562aac4be64fb635546a61e1912ff2c353360db73d2c553dcbb5a44f54,detect,high,2027-03-15,dll4_fileman.dll RAT file-manager module; single-source (Huntress),campaign:ExodusWalletRAT
sha256,2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d,detect,high,2027-03-15,dll4_socks.dll RAT SOCKS proxy module; single-source (Huntress),campaign:ExodusWalletRAT
sha256,84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756,detect,high,2027-03-15,dll4_cmd.dll RAT remote command module; single-source (Huntress),campaign:ExodusWalletRAT
sha256,5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603,detect,high,2027-03-15,dll4_script.dll RAT Lua execution module; single-source (Huntress),campaign:ExodusWalletRAT
sha256,7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8,detect,high,2027-03-15,dll4_browser.dll RAT browser-credential theft module; single-source (Huntress),campaign:ExodusWalletRAT
sha256,5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a,detect,high,2027-03-15,dll4_vnc.dll RAT hidden-VNC module; single-source (Huntress),campaign:ExodusWalletRAT
domain,us05.org,detect,high,2026-10-15,Delivery redirector; 302 to search-ms: WebDAV URI; offline at last vendor check,campaign:ExodusWalletRAT
ipv4,35.212.159.20,detect,high,2026-10-15,Hosts jn0101.msi and resolves us05.org,campaign:ExodusWalletRAT
domain,lgapistorage123.table.core.windows.net,detect,high,2026-12-15,Azure Table Storage C2 dead drop; primary,campaign:ExodusWalletRAT
domain,winapi.table.core.windows.net,detect,medium,2026-12-15,Azure Table Storage C2 dead drop; secondary or staging,campaign:ExodusWalletRAT

Install path:      %APPDATA%\ExdBackupTool\Exodus.exe   (genuine Exodus uses %LOCALAPPDATA%\exodus)
Parent process:     explorer.exe -> Exodus.exe (initial launch), svchost.exe -> Exodus.exe (hourly relaunch)
Scheduled tasks:    ExdBackupTool (hourly relaunch), INetHealth (proxy-clearing)
Named mutex:        ExodusHelper (single-instance guard; no direct Falcon telemetry, hunt via process pattern)
Temp artifact:      %TEMP%\<guid>.tmp.node (koffi native module)
MSI metadata:       Manufacturer "Apple Inc", ProductName "Background Service" (both false)
MSI ProductCode:    {4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}
MSI UpgradeCode:    {C4A1D8F2-3E5B-4C72-9A6D-1B8F0E27A3C9}
Registry remnant:   C:\Windows\Installer\SourceHash{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF} (survives directory removal)
Recon command:      cmd.exe /c chcp 65001 >nul 2>&1 & systeminfo   (spawned from inside Exodus.exe)

jn0101.msi          Trojanized installer, campaign A (filename is a per-build label, not stable)
jg0384.msi          Trojanized installer, campaign B (filename is a per-build label, not stable)
exodus_patch.js     Suppresses the Electron window (BrowserWindow.show/focus/center override)
keystorage.js       Reflective PE loader; AES-256-CBC decrypts the RAT in memory
dll4_cmd.dll        Remote command execution, STDIN/STDOUT over pipes
dll4_fileman.dll    File browse / upload / download / delete / mkdir
dll4_browser.dll    Chrome/Edge/Firefox credential, cookie, autofill theft + cookie wiper
dll4_socks.dll      SOCKS proxy relay
dll4_vnc.dll        Hidden VNC on an invisible Windows desktop
dll4_script.dll     Lua scripting engine: injection, registry CRUD, DPAPI, raw sockets
@intelcorp/wmi-native-module   npm scope impersonating Intel; used for COM/WMI host recon

\# Check whether known file extensions are hidden (1 = hidden, the risky default)
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced' -Name HideFileExt

\# Check WebClient (WebDAV) service state
Get-Service -Name WebClient | Select-Object Status, StartType

\# Check current proxy configuration for tamper
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | Select-Object ProxyEnable, ProxyServer, AutoConfigURL

\# Check Defender ASR rule state for the obfuscated-script rule
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

\# Look for the trojanized install path directly
Test-Path "$env:APPDATA\ExdBackupTool\Exodus.exe"

\# Look for the two campaign scheduled tasks
Get-ScheduledTask | Where-Object { $_.TaskName -in @('ExdBackupTool','INetHealth') }

JSON indicator array

[
  {"type":"sha256","value":"c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485","desc":"Trojanized Exodus Backup Tool MSI"},
  {"type":"sha256","value":"8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a","desc":"Decrypted modular RAT payload"},
  {"type":"sha256","value":"fdd376562aac4be64fb635546a61e1912ff2c353360db73d2c553dcbb5a44f54","desc":"dll4_fileman.dll"},
  {"type":"sha256","value":"2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d","desc":"dll4_socks.dll"},
  {"type":"sha256","value":"84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756","desc":"dll4_cmd.dll"},
  {"type":"sha256","value":"5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603","desc":"dll4_script.dll"},
  {"type":"sha256","value":"7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8","desc":"dll4_browser.dll"},
  {"type":"sha256","value":"5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a","desc":"dll4_vnc.dll"},
  {"type":"domain","value":"us05.org","desc":"Delivery redirector, offline at last check"},
  {"type":"ipv4","value":"35.212.159.20","desc":"Delivery / resolver IP"},
  {"type":"domain","value":"lgapistorage123.table.core.windows.net","desc":"Azure Table Storage C2 dead drop, primary"},
  {"type":"domain","value":"winapi.table.core.windows.net","desc":"Azure Table Storage C2 dead drop, secondary"}
]

Validation-gate summary: telemetry readiness, benign baselining, positive lab testing, and promotion criteria are detailed in Section 11. Do not enable prevent-mode on any IOA candidate before its 14-day (7-day for Q4) clean observation window completes.