Tampered Exodus Installer Hides Modular RAT with Remote Access and Credential-Theft Features

Sep 1, 2026 · Original article ↗

Summary

Huntress details a campaign using fake documents and software updates to install a trojanized Exodus wallet that loads a modular RAT, enabling hidden remote access, browser credential theft, and SOCKS proxying.

Key points

Four Huntress-protected organizations were compromised between late July and mid-August 2026; three incidents occurred within 85 minutes on August 18.
Lures included fake PDF files and JavaScript files inside ZIP archives; both silently downloaded and ran an MSI installer.
The installer deployed a genuine Exodus 24.33.4 wallet modified with three malicious files, while suppressing its visible interface.
A replaced wallet component decrypted and manually loaded a 10 MB RAT payload into memory without writing it to disk.
RAT modules enabled remote command execution, file management, hidden VNC access, SOCKS proxying, and theft of browser passwords, cookies, and extensions.
The malware used Azure Table Storage for observed command-and-control tasking and results, and a scheduled task relaunched the wallet hourly.
Huntress recommends treating affected hosts as full interactive compromises, revoking sessions and rotating credentials, and removing both the files and scheduled tasks.

Article Details

Attack Vectors: A fake document named with a .pdf.js double extension was opened from a browser download; Windows Script Host ran the JavaScript, which opened a legitimate decoy PDF, downloaded an MSI to %TEMP%, and launched it with msiexec.
A JavaScript file inside a ZIP disguised as a software update was opened from Explorer's compressed-folder view and staged in a temporary folder before execution; it opened a decoy PDF and installed the MSI.
A WebDAV/search-ms delivery path was identified on the same delivery infrastructure, but Huntress did not observe it used in the four investigated endpoint executions.
The trojanized Exodus installer used a JavaScript PE loader to decrypt and manually map the RAT payload into memory.
Defensive Notes: Show file extensions in Explorer and block or alert on Windows Script Host execution from user download folders.
Disable the WebClient service where WebDAV is not required, and treat browser prompts to open Windows Explorer as suspicious.
Treat affected hosts as full interactive compromises; revoke active sessions and rotate credentials because browser credentials and session cookies may have been stolen.
Remove the ExdBackupTool scheduled task as well as the per-user install directory; inspect other user profiles on shared machines.
Investigate Exodus.exe running from %APPDATA% as a child of explorer.exe without a visible window, the .tmp.node artifact in %TEMP%, and the ExodusHelper mutex.
Look for scheduled tasks that repeatedly clear ProxyEnable, ProxyServer, and AutoConfigURL, including tasks registered through the Task Scheduler COM API.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`us05[.]org`	Delivery domain that redirected to a search-ms URI for the attacker's WebDAV share.
HOSTNAME	`api[.]27inbarbadostours[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]504guaratv[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]b2compages[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]elcaminodesermadre[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]ideasnation[.]net`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]jyfgarriga[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]onemkscleaningsolutions[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]rezperfect[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]shopfoora[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`api[.]shuyinla[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]bcntextilrep[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]conviertenoensi[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]geutex[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]micheladafestelpaso[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]rtpsenior4djp[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]sentiented[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]shuchipharmacy[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]springstore[.]net`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`app[.]stateyatra[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`auth[.]auravp3[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`auth[.]clubvp3[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`auth[.]esalesrep[.]net`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`auth[.]h-dsf1034[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`auth[.]nailedbynakole[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`auth[.]secureswallow[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`auth[.]shuchimed[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`auth[.]speaktowinclients[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]baraldes[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]cobraporganardinero[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]estudiod2[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]jiyaoglass[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]planningportfolioweek[.]org`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]shinozen[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]snsafirieik[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]speaktogrowbiz[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`cdn[.]yenoox[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`lgapistorage123[.]table[.]core[.]windows[.]net`	Azure Table Storage dead-drop C2 host observed receiving tasking and results.
HOSTNAME	`static[.]ariesglobalsoft[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`static[.]cistecca360[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`static[.]emialvarez[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`static[.]gompl-rggsrve[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`static[.]metodorace[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`static[.]premios-king[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`static[.]suplenation[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`static[.]trythecrowdmakers[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`static[.]turboleadslab[.]com`	Configured in the RAT as a possible C2 host but not contacted; the article cautions it may be a legitimate domain whose owner is a victim.
HOSTNAME	`winapi[.]table[.]core[.]windows[.]net`	Second hardcoded Azure Table Storage C2 account; it received a table-creation request, but its role was not established.
IPV4	`35[.]212[.]159[.]20`	Delivery IP that hosted the MSI and resolved us05[.]org.
SHA256	`2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d`	Hash of the RAT's SOCKS proxy module.
SHA256	`5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603`	Hash of the RAT's script-execution module.
SHA256	`5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a`	Hash of the RAT's hidden VNC module.
SHA256	`7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8`	Hash of the RAT's browser credential-stealer module.
SHA256	`84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756`	Hash of the RAT's remote shell module.
SHA256	`8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a`	Hash of the decrypted, memory-resident modular RAT payload.
SHA256	`c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485`	Hash of the fake Exodus Backup Tool MSI installer.
SHA256	`fdd376562aac4be64fb635546a61e1912ff2c353360db73d2c553dcbb5a44f54`	Hash of the RAT's remote file-manager module.