The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT

MITRE Techniques

• [T1059.007] JavaScript – The initial droppers and obfuscated components were JavaScript-based, including fake PDF.js delivery and heavily obfuscated wallet modifications (‘the malicious Javascript… downloads a Microsoft Installer’).
• [T1204.002] User Execution: Malicious File – Victims opened disguised files such as a fake PDF or ZIP update, triggering execution (‘what the user saw appeared to be a legitimate document’ and ‘the user opened it straight out of Explorer’).
• [T1036.007] Masquerading: Double File Extension – A file named like a PDF actually ended in .pdf.js to hide its true type (‘file name ending in .pdf.js’).
• [T1218.007] System Binary Proxy Execution: Msiexec – The payload was installed silently using msiexec (‘msiexec /i “%TEMP%jn0101.msi” /quiet /norestart’).
• [T1105] Ingress Tool Transfer – The JavaScript dropper downloaded and staged an MSI payload (‘it downloads… a Microsoft Installer (MSI), writes it to %TEMP%’).
• [T1053.005] Scheduled Task – The malware used scheduled tasks for persistence and proxy clearing (‘a scheduled task named INetHealth’ and ‘ExdBackupTool’).
• [T1102.002] Web Service: Bidirectional Communication – The payload used Azure Table Storage as a dead drop for tasking and results (‘POST https://lgapistorage123.table.core.windows.net/Tables’ and rows prefixed T_ / R_).
• [T1021.002] Remote Services: SMB/Windows Admin Shares is not directly shown; not listed.
• [T1021.001] Remote Services: Remote Desktop Protocol – The RAT included hidden VNC for interactive remote desktop access (‘Hidden VNC, interactive remote desktop’).
• [T1090.001] Proxy: Internal Proxy – The RAT included a SOCKS module that turned the host into a relay (‘SOCKS proxy, turning the host into a relay’).
• [T1055] Process Injection is implied but not explicitly described; not listed.
• [T1106] Native API – The payload used low-level Windows APIs such as VirtualAlloc, WriteProcessMemory, and RtlAddFunctionTable to manually map and run code (‘That is a manual Portable Executable (PE) loader’).
• [T1041] Exfiltration Over C2 Channel – Stolen browser data and command output were sent through the C2 framework (‘browser credential theft’ and result rows in Azure Table Storage).
• [T1112] Modify Registry – The INetHealth task modified Internet Settings registry values to disable proxy settings (‘Set-ItemProperty… ProxyEnable 0’).
• [T1219] Remote Access Software – The modular RAT bundled capabilities for persistent remote access and control (‘hidden VNC’, ‘remote command execution’, ‘file browse’).