Full Report
Exodus crypto wallet analysis by Huntress uncovered tampered installers hiding a modular RAT focused on stealing credentials, not coins.
Analysis Summary
# Tool/Technique: Tampered Exodus Wallet Installer (Modular RAT)
## Overview
This attack involves a tampered version of the legitimate Exodus cryptocurrency wallet installer (v24.33.4). Instead of stealing cryptocurrency directly, the malware disables the wallet's user interface and uses the application's legitimate structure to load a modular Remote Access Trojan (RAT). The primary goal of the infection is credential theft and maintaining long-term remote access via stealthy communication channels.
## Technical Details
- **Type:** Malware / Modular RAT
- **Platform:** Windows
- **Capabilities:** Credential theft (browsers), hidden VNC (hVNC), SOCKS proxy, fileless execution, and persistence.
- **First Seen:** July 2024 (Activity peaked August 2026 per report timeline)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment] (Fake .pdf.js files)
- [T1204.002 - User Execution: Malicious File]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1059.007 - Command and Scripting Interpreter: JavaScript]
- **[TA0003 - Persistence]**
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1620 - Reflective Code Loading] (PE loader mapping payload to memory)
- [T1036 - Masquerading] (MSI signed as "Apple Inc"; Task named "INetHealth")
- [T1564.003 - Hijack Execution Flow: Hidden Window] (`conhost.exe --headless`)
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers]
- **[TA0011 - Command and Control]**
- [T1102.002 - Web Service: Bidirectional Communication] (Azure Table Storage)
- [T1090 - Proxy] (SOCKS proxy capability)
## Functionality
### Core Capabilities
- **Tampered Installer:** Uses a Windows Installer package (MSI) that declares itself a "Background Service" by "Apple Inc" to install a functional but hidden Exodus wallet.
- **Fileless Payload Loading:** A modified legitimate Exodus source file acts as a PE loader. It decrypts a ~10 MB payload directly into memory, ensuring the RAT never touches the disk as a standalone executable.
- **Persistence:** Establishes a scheduled task (e.g., `INetHealth`) that executes every hour to re-initialize the RAT.
### Advanced Features
- **Stealthy C2:** Uses Azure Table Storage for beaconing and command retrieval instead of a traditional attacker-owned domain, blending in with legitimate cloud traffic.
- **Modular Design:** Includes a hidden VNC (hVNC) for remote desktop interaction and a SOCKS proxy to tunnel traffic through the infected host.
- **UI Suppression:** Specifically modifies the Exodus wallet code to prevent any windows from drawing, keeping the victim unaware that the software is "running."
## Indicators of Compromise
- **File Names:**
- `[Name].pdf.js`
- `Exodus-24.33.4.msi` (Tampered version)
- **Registry Keys:** Check for persistence under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` or Scheduled Tasks.
- **Network Indicators:**
- Beacons to Azure Table Storage endpoints (e.g., `*.table.core.windows[.]net`).
- **Behavioral Indicators:**
- `conhost.exe` running with the `--headless` flag.
- `powershell.exe` spawning with Base64 encoded commands from scheduled tasks.
- Presence of Exodus wallet files in environments where crypto-currency software is not authorized.
## Associated Threat Actors
- **Unknown:** The report does not link this specific campaign to a named threat group, though the techniques (ClickFix lures, Azure C2) are common among sophisticated e-crime actors.
## Detection Methods
- **Behavioral Detection:** Monitor for `conhost.exe --headless` combined with PowerShell execution. Audit the creation of new scheduled tasks that execute scripts or encoded commands.
- **File Integrity:** Monitor for modifications to legitimate application files (specifically within the Exodus installation directory).
- **Network Monitoring:** Alert on unusual or frequent outbound connections to Azure Table Storage from non-server workstations.
## Mitigation Strategies
- **File Extension Visibility:** Ensure Windows is configured to show all file extensions to prevent users from clicking `.pdf.js` files.
- **Application Whitelisting:** Prevent the installation of unauthorized software like cryptocurrency wallets in corporate environments.
- **Restrict Scripting Host:** Disable or restrict `wscript.exe` and `cscript.exe` for standard users if not required for business operations.
## Related Tools/Techniques
- **ClickFix:** Similar social engineering lures involving fake updates or document errors.
- **Reflective DLL Injection:** The underlying method used by the PE loader to map the RAT into memory.
- **Living off the Cloud:** The technique of using legitimate cloud services (Azure) for C2 infrastructure.