The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT

A malicious MSI that installs a genuine-but-trojanized Exodus Wallet was used to deploy a modular RAT (memory-resident PE) that hides the UI, establishes persistence via a per-user scheduled task, and provides hands-on access (hidden VNC, SOCKS, browser credential theft). Delivery methods included disguised .pdf.js, ZIP extraction-to-temp, and a WebDAV search-ms capability; C2 used Azure Table Storage as a dead-drop. The toolkit is highly obfuscated, employs reflective PE loading and k0ffi FFI usage, and left multiple usable IOCs (MSI hashes, DLL module hashes, scheduled task names, install path, mutex).