The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT

What it is

A Huntress investigation into a trojanized Exodus Wallet 24.33.4 installer that compromised four unrelated Huntress-protected organizations between late July and mid-August 2026 (three hit on August 18 within 85 minutes, using an installer built the day before). The installer drops the real wallet but takes care that the victim never opens it, while deploying a modular RAT that targets browser credentials.

How it works / IR fingerprints

The summary covers the three delivery vectors and msiexec MSI staging. What the page adds is hunt-and-response specificity:

• The dropper MSI stays on disk. The JavaScript tries to delete the MSI after 5 seconds via setTimeout, but that function does not exist in Windows Script Host — the call throws, an empty catch swallows it, and cleanup never happens. During IR the MSI is very likely still in %TEMP%.
• MSI filenames are labels, not indicators. Observed jn0101.msi and jg0384.msi — two letters plus four digits, different per campaign. Do not treat the name as an IOC.
• ZIP-in-Explorer fingerprint. When a JS file is run from Explorer's compressed-folder view without extraction, Explorer stages it under %LOCALAPPDATA%\Temp\, leaving a path fragment like ...Update_GS_7G0N-254V38L2350.zip.116\...js. The .zip.116\ fragment is the tell.
• Browser as parent process. On two .pdf.js endpoints the parent was chrome.exe — the file was opened straight from the browser's download bar.
• The July scheduled task. An earlier July 24 intrusion had no document: a scheduled task named INetHealth launched conhost.exe --headless powershell -e with a Base64 blob. Huntress initially misread this as ClickFix — conhost.exe --headless is a legitimate developer function and says nothing about how the command arrived. The decoded PowerShell downloaded nothing; the page flags this as the investigation's most useful clue but does not (in this excerpt) say what it did.

Infrastructure

• IP 35.212.159.20 served the first installer and the unused third vector.
• The search-ms vector redirected (HTTP 302) to search-ms:...\\us05.org@8080\update; the @8080 suffix forces the WebClient service to mount over WebDAV so listed files live on the attacker's server. us05.org was offline at last check.
• Legitimate CDNs/domains hosted the real decoy PDFs (Storyblok; law.georgetown.edu), so decoy-host reputation is not a useful signal.

Caveats

The page states the observed delivery methods "should not be read as a complete list of what this actor has available." The third (search-ms/WebDAV) vector was found on the infrastructure but no victim took it. One user grew suspicious when a legal brief arrived in place of an expected software update, searching "are JavaScript files spam or Trojan horses" — the lure mismatch, not the tooling, was what got noticed.