The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT

This threat involves a sophisticated modular RAT masquerading as the Exodus cryptocurrency wallet installer version 24.33.4. The attacker delivers a tampered Windows Installer package that installs the legitimate wallet but modifies three files to prevent the UI from displaying and to establish persistent remote access. The RAT's payload consists of six modules providing capabilities such as hidden VNC access, SOCKS proxying, browser credential theft, file management, remote shell access, and script execution. Communication with the attacker is conducted via Azure Table Storage acting as a dead drop, avoiding detection through conventional command and control domains. Persistence is maintained by scheduled tasks executing hourly, and the malware includes techniques to bypass corporate proxy settings. Infection occurs through social engineering vectors including fake PDFs and JavaScript-based droppers.

The RAT enables attackers to maintain persistent, stealthy remote access to compromised systems, allowing them to steal browser credentials, manage files, execute arbitrary commands and scripts, proxy network traffic, and remotely control the system via hidden VNC. The use of Azure Table Storage for command and control reduces the likelihood of detection by traditional network security tools. The malware's ability to bypass corporate proxy configurations further complicates network-based detection and mitigation. This can lead to significant data theft, espionage, and potential further compromise within affected organizations.

No official patch or remediation is indicated for this threat as it involves a tampered installer rather than a software vulnerability. Organizations should avoid downloading Exodus wallet installers from untrusted sources and verify the integrity of installation files. Security teams should monitor for indicators of compromise such as unexpected scheduled tasks running hourly, unusual Azure Table Storage access patterns, and the presence of hidden VNC or SOCKS proxy modules. User education to recognize phishing attempts involving fake PDFs and JavaScript droppers is recommended. Incident response should focus on removing the RAT and restoring affected systems from known good backups.