--- title: Trojanized Exodus Wallet Installer Delivers Modular RAT via ClickFix Lure - Capstone Technologies Group description: Huntress found tampered Exodus Wallet 24.33.4 installers on four networks, hiding a modular RAT that steals Chrome, Edge and Firefox credentials via hidden VNC. canonical_url: https://captechgroup.com/threat-intelligence-center/trojanized-exodus-wallet-installer-delivers-modula-54c554 language: en-GB date: 2026-09-05T12:37:30Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/trojanized-exodus-wallet-installer-delivers-modula-54c554. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 6332 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/trojanized-exodus-wallet-installer-delivers-modula-54c554. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. Huntress identified tampered **Exodus cryptocurrency wallet installers** on four unrelated customer networks between late July and mid-August 2026. The package installs a genuine copy of Exodus Wallet 24.33.4, takes deliberate steps to make sure the application never displays a window, and runs a modular remote access trojan in the background that targets browser credentials rather than coins. Original reporting for this article comes from [Huntress](https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat "Source: Huntress"). Three of the four organizations were compromised on August 18, within 85 minutes of each other, using an installer compiled the day before. The MSI carrying it was 210,767,872 bytes, unsigned, and carried false metadata listing **Apple Inc** as the manufacturer and "Background Service" as the product name. > At the time of Huntress's analysis, the installer was detected by 0 of 76 engines on VirusTotal. The July detection initially looked like ClickFix, and it is worth knowing why. ClickFix is a social engineering pattern where a fake verification or update page instructs the visitor to paste a command into Windows or open a file they just downloaded, so the person completes the risky step themselves and browser download warnings get clicked past by the victim. The tell in that case was `conhost.exe --headless powershell -e` followed by a Base64 blob, a command shape that shows up in ClickFix cases but is also a normal Windows developer function. What Huntress actually observed were two delivery paths. One was a fake PDF named with a `.pdf.js` double extension, opened straight out of `chrome.exe` after download, since Windows hides known extensions by default. The other was an archive named `Update_GS_7G0N-254V38L2350.zip` holding a single JavaScript file, opened from Explorer's compressed folder view without extracting it first. If your staff open documents delivered through a browser, that is the exposure here. Two victims believed they were opening work material, a marketing ebook and a legal brief, and both documents were real and hosted on domains they had no reason to question. The wallet was the disguise, and nobody in those offices was ever meant to open it. ## From Lure to Loader: The Infection Chain and MSI Payloads The infection starts with a file the user believes is a document. On three endpoints, a JavaScript file named to end in `.pdf.js` arrived through the browser, and because Windows hides known extensions by default, the victim saw a PDF. Both instances show `chrome.exe` as the parent process, meaning the file was launched straight from the download shelf and handed to Windows Script Host (MITRE T1204.002 and T1059.007). The script does two things at once. It opens a genuine decoy document so the victim gets what they expected, one a marketing ebook served from Storyblok and another a real legal brief pulled live from `law[.]georgetown[.]edu`, while in the background it writes an MSI to `%TEMP%` and runs `msiexec /i "%TEMP%\jn0101.msi" /quiet /norestart`. Every document the user actually saw was hosted on a domain with a clean reputation. A second delivery route swapped the double extension for an archive, `Update_GS_7G0N-254V38L2350.zip`, holding a single ordinary `.js` file. The user ran it from Explorer's compressed folder view without extracting, which leaves a distinctive staging path containing a `.zip.116\` fragment under `%LOCALAPPDATA%\Temp\`. That chain installed `jg0384.msi`. A third route was found on the delivery infrastructure but never used against a victim: `us05[.]org` returned an HTTP 302 to a `search-ms:` URI with an `@8080` suffix, mounting an attacker-controlled WebDAV share inside a window that looks like local search results. The MSI itself is a thin wrapper. Built with WiX Toolset 6.0 and unsigned, it carries no Registry table, no Service table, and no Scheduled Task table. It drops six files into `%APPDATA%\ExdBackupTool\` and fires exactly one custom action, `LaunchExodus: [WindowsFolder]explorer.exe "[INSTALLDIR]Exodus.exe"`. Launching through the shell drops the elevated `msiexec` token and re-parents the wallet under `explorer.exe`, so in a process tree it reads as a user double-click. The per-user install path also means no administrator prompt ever appears. Three of the 1,973 files inside `app.asar` were altered. `keystorage.js` holds an AES-256-CBC blob of 10,021,392 bytes at an entropy of 8.000, decrypted with a key and IV hardcoded in the same file, and mapped into memory using `koffi` to call `VirtualAlloc`, `WriteProcessMemory`, `RtlAddFunctionTable`, and `CreateThread`. That is a reflective PE loader written in JavaScript (T1620), so the payload never touches disk and never reaches VirusTotal. Decrypted, it is a 10 MB PE32+ whose `.rdata` section stores six plugin DLLs, each exporting its own name: remote command execution, a file manager with HTTP upload and download, a browser stealer covering Chrome, Edge, and Firefox passwords, cookies, and autofill, a SOCKS proxy, hidden VNC that builds a second invisible desktop against a copy of the victim's browser profile, and a LuaJIT script engine supporting injection, registry operations, DPAPI, and raw sockets. The source shows no clipboard or seed-phrase theft capability. Hidden VNC plus SOCKS means an operator can work interactively on the host and use it to reach the rest of your network. Command and control runs over WebSockets via WinHTTP with `bcrypt` encryption, but the observed channel was an Azure Table Storage dead drop at `lgapistorage123.table.core.windows.net`, table `ftable434`, where `T_` rows carry tasking and `R_` rows carry results keyed by bot ID. Forty-five backup hosts using `api.`, `cdn.`, and `auth.` prefixes sit in the config block unused. Persistence comes from an `ExdBackupTool` task registered through the Task Scheduler COM API, relaunching the wallet hourly from `svchost.exe`, alongside an `INetHealth` task that blanks `ProxyEnable`, `ProxyServer`, and `AutoConfigURL` to force beacon traffic around the corporate proxy. - `jn0101.msi` SHA256 c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485 - `jg0384.msi` and `Update_GS_7G0N-254V38L2350.zip` (second delivery chain) - Decrypted RAT payload SHA256 8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a - `dll4_browser.dll` 7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8, `dll4_vnc.dll` 5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a, `dll4_socks.dll` 2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d - Delivery host 35.212.159\[.\]20 and `us05[.]org`, WebDAV share `\\us05.org@8080\update` - Mutex `ExodusHelper`, MSI ProductCode {4046AD2B-3831-4011-AEAD-D98C5C9FD1EF} Fake document to tampered wallet: the infection chain 1 A JavaScript file ending in .pdf.js arrives through the browser and appears as a PDF because Windows hides known extensions. It launches from the download shelf with chrome.exe as parent and is handed to Windows Script Host (T1204.002, T1059.007).Invoice.pdf.js → wscript.exeHigh 2 A second route ships a ZIP holding one plain .js file, run straight from Explorer's compressed folder view without extraction. A third, unused route returned an HTTP redirect to a search-ms: URI that mounts an attacker WebDAV share.%LOCALAPPDATA%\\Temp\\...zip.116\\Medium 3 The script opens a genuine decoy document from a clean-reputation domain so the victim sees what was expected, while writing an MSI to %TEMP% and running it quietly in the background.msiexec /i "%TEMP%\\jn0101.msi" /quiet /norestartHigh 4 The unsigned WiX-built package carries no Registry, Service, or Scheduled Task table. It drops files into a per-user AppData folder, so no administrator prompt appears, and fires a single custom action.LaunchExodus: \[WindowsFolder\]explorer.exe "\[INSTALLDIR\]Exodus.exe"Medium 5 Launching via the shell drops the elevated msiexec token and re-parents the wallet under explorer.exe, so the process tree reads as a user double-click. Inside app.asar, a small set of files is altered, including an AES-CBC encrypted blob decrypted with a key and IV hardcoded alongside it and mapped into memory.%APPDATA%\\ExdBackupTool\\ → app.asar\\keystorage.jsHigh ## What a Compromised Wallet Endpoint Costs the Business The most expensive fact in this campaign is that the six modules stored in the payload's `.rdata` section do not describe a coin stealer. They describe a general-purpose remote access toolkit that happens to arrive dressed as a wallet, and a single infected laptop gives an operator the same reach a hired contractor would have with your user's login. Hidden VNC, a SOCKS proxy, and a browser stealer in the same package is not a crypto-theft toolkit. It is full interactive access with a pivot. What that buys the operator on your endpoint breaks down cleanly: - **dll4\_vnc.dll** creates a second invisible Windows desktop and relaunches Chrome or Edge there against a copy of the user's profile, so the attacker browses as your employee while they work unaware on the visible desktop. - **dll4\_browser.dll** takes passwords, cookies, autofill data, and extension data from Chrome, Edge, and Firefox, and includes a cookie wiper that forces a fresh login the attacker can capture. - **dll4\_socks.dll** turns the host into a relay, so traffic to third parties leaves from your corporate address space. - **dll4\_script.dll** runs a LuaJIT engine in-process with registry access, DPAPI, raw sockets, and token queries, which means new capability arrives without a new file on disk. The cookie theft is where a wallet infection turns into an identity incident. A stolen session cookie carries your user past SSO and past MFA, so an account stays reachable after the password changes. If that laptop holds live sessions to your VPN portal, your email tenant, your payroll platform, or your banking portal, the attacker inherits every one of them at the permission level your user already holds. Your egress logs will be thinner than you expect. The hourly maintenance task blanks `ProxyEnable`, `ProxyServer`, and `AutoConfigURL` under the user's Internet Settings key, which pushes the command and control WebSocket traffic around your corporate proxy and out through a direct connection. Anything your proxy would normally have recorded, inspected, or blocked simply never reached it, and rebuilding what left the host becomes a memory and endpoint exercise instead of a log query. Tasking and results move through Azure Table Storage at `table.core.windows.net`, a Microsoft domain that sits on no blocklist and appears in ordinary business traffic. There is no attacker-owned server in the path, so the channel stays up while an abuse report works its way through Microsoft, and your network telemetry gives you little to pivot on during scoping. Budget for a longer investigation than a normal malware cleanup. The RAT never touches disk, the persistence task was registered through the Task Scheduler COM API so no command line records its creation, and every artifact is per-user, meaning a shared workstation has to be examined profile by profile. That is forensic labor, not a reimage decision. Disclosure follows from what the browser module touched. If saved credentials or session data reached client portals, payment systems, or health or financial records, you are working to contractual notification clauses and regulatory timelines based on presumed exposure, because you cannot prove which stored items were read. Treasury teams, finance staff, and crypto-adjacent firms carry additional exposure here. Outbound cryptocurrency transfers do not reverse, and an operator sitting inside a live browser session on a finance workstation can move funds using approvals your systems already granted. When the money involved belongs to clients, the recovery conversation includes them. ## Detection Opportunities Across Endpoint and Network Telemetry The most reliable endpoint signal in this campaign is an hourly process launch you can time. Telemetry from one August case shows `svchost.exe` starting `C:\Users\\AppData\Roaming\ExdBackupTool\Exodus.exe` at 42 minutes past every hour, with Task Scheduler as the parent. Most hours record it twice, likely a second instance dying against the `ExodusHelper` mutex. The task was registered through the Task Scheduler COM API instead of `schtasks.exe`, so there is no process creation event to catch (MITRE T1053.005). Hunting has to work from Task Scheduler operational event logs and the task XML on disk, since command-line hunting alone returns nothing. For a SOC running command-line-heavy detection logic, this is the difference between an alert and a silent hourly relaunch. Process lineage gives a second angle. An Electron binary running out of a per-user directory, parented to `explorer.exe`, with no visible window is unusual on its own, and the payload spawns `cmd.exe /c chcp 65001 >nul 2>&1 & systeminfo` from inside that wallet process for host recon (T1082). A cryptocurrency wallet enumerating system inventory through a UTF-8 console is worth a ticket every time. File and registry artifacts worth querying across the estate: - `%TEMP%\.tmp.node`, the `koffi` FFI module extracted at runtime - Leftover installers in `%TEMP%` using a two-letter, four-digit naming scheme, left behind because the dropper's cleanup call throws and fails silently - The Uninstall key entry with ProductCode `{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}` and the reversed UpgradeCode under `HKLM\SOFTWARE\Classes\Installer\UpgradeCodes` - `C:\Windows\Installer\SourceHash{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}`, which survives deletion of the install directory - Repeated writes to `ProxyEnable`, `ProxyServer`, and `AutoConfigURL` under `HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings` (T1112) Those proxy writes pair with `conhost.exe --headless powershell -e` plus a Base64 blob under a task named `INetHealth`. Recurring proxy-clearing activity on a schedule tells you the operator has already had egress inspected or blocked on that host and built maintenance to undo it, which pushes the incident timeline back well before the alert fired. On the delivery side, look for `msiexec` running with `/i "%TEMP%\...msi" /quiet /norestart` where the parent is Windows Script Host (T1218.007). Explorer's compressed-folder view leaves its own fingerprint: a staged execution path under `%LOCALAPPDATA%\Temp\` containing a `.zip.116\` fragment tells you a script ran from inside an archive that was never extracted. WebClient service starts and SMB or WebDAV connections to `\\us05.org@8080\update` or to `35.212.159[.]20` cover the `search-ms:` route, which nobody in the observed intrusions took. Proxy logs are where the command and control shows. The observed channel is Azure Table Storage: `POST`, `PUT`, `GET`, and `DELETE` against `lgapistorage123.table.core.windows.net` and `winapi.table.core.windows.net`, table name `ftable434`, with the bot ID as PartitionKey and RowKeys prefixed `T_` and `R_`. Also flag WinHTTP WebSocket upgrades from processes that have no business holding a persistent socket. Traffic to genuine Exodus infrastructure continues alongside all of this, so clean wallet netflow does not clear a host. The 45 configured hosts using `api.`, `cdn.`, `static.`, `app.`, and `auth.` prefixes on small-business domains were never contacted during detonation and belong in a hunt list as leads, not blocklist entries. Hash indicators age out quickly here, with related builds such as `ton435.msi` and two files named `setup1.msi` all sitting at zero detections. ## Immediate Containment and Hardening Steps Pull the network cable on any host where that MSI ran before you start collecting evidence. An operator with interactive access and a proxy module can watch you work, and containment matters more than a clean forensic timeline here. Isolate the endpoint at the switch or through your [EDR](https://captechgroup.com/services/cybersecurity-services "Cybersecurity Services | Protect Your Business with Capstone Technologies")'s network quarantine, and keep the machine powered on so the in-memory payload and its mutex state remain available for triage. Treat every credential and key that touched that profile as taken. Any wallet seed phrase, private key, or exchange session used on that machine should be considered exposed, so generate a new wallet on a device you know is clean and move funds before you do anything else. For corporate accounts, rotate passwords and revoke active sessions and OAuth tokens, because a stolen session cookie keeps working after a password reset. Cleaning the user profile tells you nothing about the other profiles on a shared machine. Every artifact in this campaign is per-user. Cleanup has to cover more than the files. Delete the `ExdBackupTool` scheduled task as well as the install directory, since removing only the folder leaves an hourly task pointing at a path that no longer exists. Then check for leftovers the installer registers elsewhere: - The dropper MSI is very likely still in `%TEMP%`, because the JavaScript cleanup call was written against a function Windows Script Host does not have and silently failed. - `C:\Windows\Installer\SourceHash{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}` survives deletion of the install directory. - The product's Uninstall key entry and the reversed `UpgradeCode` GUID under `HKLM\SOFTWARE\Classes\Installer\UpgradeCodes`. - `HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings`, where `ProxyEnable`, `ProxyServer`, and `AutoConfigURL` were blanked. Confirm group policy has pushed your proxy configuration back after removal. Block `35.212.159[.]20` and `us05[.]org` at the perimeter. The Azure Table Storage channel needs a different approach, since `table.core.windows.net` is a legitimate Microsoft endpoint that sits on nobody's blocklist. File an abuse report with Microsoft for the storage account and, where your business does not use Azure Storage directly, restrict outbound access to that service and alert on table API calls from workstations. The 45 prefixed small-business hostnames in the config are leads for hunting, and some of those domain owners are likely victims themselves. For hardening, four changes cut off what you have seen here. Turn on file extension visibility in Explorer through group policy so a `.pdf.js` name reads as what it is. Block or alert on Windows Script Host execution from user download and temp folders. Disable the WebClient service on any endpoint that does not need WebDAV, which stops Explorer from mounting a remote share behind a search results window. Add AppLocker or WDAC rules that prevent `msiexec` from installing packages located in user-writable directories, and require administrative approval for MSI installation. Longer term, keep treasury and crypto operations on a dedicated hardened workstation or a hardware wallet workflow that never shares a browser profile with day-to-day email. Tune your EDR to alert when an installer spawns a scripting engine, and when an application installs to `%APPDATA%` and starts by way of `explorer.exe`. In environments Capstone manages, Adlumin watches authentication behavior for sign-ins that do not match the user's normal pattern, which is how a reused session cookie surfaces after the endpoint is already clean. Incident response sequence for the MSI infection 1 Disconnect the endpoint at the switch or through EDR network quarantine before evidence collection, since the operator has interactive access. Keep the machine powered on so the in-memory payload and mutex state stay available.High 2 Regenerate wallet seed phrases and private keys on a known-clean device and move funds first. For corporate accounts, rotate passwords and revoke active sessions and OAuth tokens, because a stolen session cookie survives a password reset.High 3 Delete the scheduled task alongside the install directory; removing only the folder leaves the task pointing at a missing path. Artifacts are per-user, so review every profile on a shared machine.ExdBackupTool 4 The dropper MSI usually remains in the temp directory because the Windows Script Host cleanup call failed silently. Check the SourceHash file, the Uninstall key, the reversed UpgradeCode GUID, and the blanked proxy values.HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings 5 Block the hardcoded IP and domain at the perimeter. The Azure Table Storage channel needs an abuse report to Microsoft and outbound restrictions, since the endpoint is legitimate and unlisted on blocklists.table.core.windows.net ## Key Takeaway for Organizations Handling Crypto Assets Every delivery path in this campaign ends the same way: a person you employ double-clicks something and Windows does exactly what it was designed to do. No exploit, no unpatched appliance, no stolen VPN credential. That is why this style of intrusion, whether it arrives as a fake document or as a pasted command, is difficult to stop with a blocklist. The victim is the one executing the code, and the execution itself looks legitimate at every layer of your telemetry. Hash-based blocking ages out quickly here. The same builder has produced `ton435.msi` at 211,038,208 bytes, two separate files named `setup1.msi` at roughly 200 MB each, and another unnamed 210,894,848-byte package, all at zero detections. Your indicator list expires the next time the operator runs their build script, while the structural habits behind those files stay constant. The action that matters most is controlling MSI execution from user-writable paths. If an installer can run out of a temporary folder under a standard user's own token, the delivery method becomes irrelevant, because whatever reaches your user's hands will install cleanly. Restricting that one behavior removes the step every chain in this campaign depends on. The second point is scoping. If this installer ran on a machine, treat that host as fully compromised rather than as a malware cleanup. Any wallet seed phrase, private key, exchange session, or browser-stored credential that touched that profile should be considered in the operator's hands, and any crypto asset reachable from those keys should be moved to a wallet generated on a clean system. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-09-05T12:37:30Z", "datePublished": "2026-09-05T12:37:30Z", "description": "Huntress found tampered Exodus Wallet 24.33.4 installers on four networks, hiding a modular RAT that steals Chrome, Edge and Firefox credentials via hidden VNC.", "headline": "Trojanized Exodus Wallet Installer Delivers Modular RAT via ClickFix Lure", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/trojanized-exodus-wallet-installer-delivers-modula-54c554" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/trojanized-exodus-wallet-installer-delivers-modula-54c554" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```