#ParsedReport #CompletenessHigh
02-09-2026

The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT

https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat

Report completeness: High

Threats:
Hvnc_tool
Clickfix_technique
Bloat_technique
Dead_drop_technique

Victims:
Huntress protected organizations

Industry:
Transport, Education

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1012, T1021.005, T1027, T1036.004, T1036.005, T1036.007, T1053.005, T1059.001, T1059.007, T1070.004, have more...

IOCs:
Command: 3
Path: 8
File: 27
IP: 1
Domain: 46
Hash: 8
Registry: 1
Url: 1

Soft:
Windows Installer, Electron, Node.js, macOS, Linux, WinHTTP, Task Scheduler, Chromium, Windows Explorer, Chrome, have more...

Wallets:
exodus_wallet

Crypto:
bitcoin, ethereum, solana

Algorithms:
sha256, zip, base64, bcrypt, aes-256-cbc

Functions:
setTimeout, show, focus, center, require, JavaScript, Set-ItemProperty, InternetSetOption

Win API:
VirtualAlloc, GetCurrentProcess, GetProcAddress, RtlAddFunctionTable, WinHttpWebSocketSend, WinHttpWebSocketReceive, WinHttpWebSocketCompleteUpgrade, NtMapViewOfSection, NtProtectVirtualMemory, RegisterClassA, have more...

Win Services:
WebClient

Languages:
lua, powershell, javascript

Platforms:
intel, x64, arm, apple