{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The Exodus RAT uses a legitimate, signed runtime and valid wallet code to bypass traditional security controls. A negative result confirms that these stealthy installers haven't compromised the user estate." }, "name": "Tampered Exodus Wallet Persistence and C2", "type": "investigation", "labels": [ "hunt", "attack.t1053.005", "attack.t1059.001", "attack.t1564.003", "attack.t1027", "attack.t1071.001" ], "series": { "slug": "the-crypto-wallet-that-never-opened-tampered-exodus-installer-hides-a-modular-rat", "index": 2, "title": "The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT", "total": 2 }, "related": [ { "hunt": "javascript-dropper-initial-access", "reason": "The masqueraded JavaScript dropper (.pdf.js) and the initial MSI execution are handled by a separate hunt focused on delivery.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A standard rule might fire on PowerShell with an encoded command, but this hunt correlates persistence with rare application paths and network traffic, reducing noise from legitimate headless conhost use.", "coverage": [ { "stage": "defense-evasion-ui-suppression", "steps": [ "rare-exodus-paths" ], "status": "covered" }, { "stage": "persistence-headless-scheduled-task", "steps": [ "headless-powershell-tasks" ], "status": "covered" }, { "stage": "command-and-control-network-activity", "steps": [ "c2-network-traffic" ], "status": "covered" }, { "stage": "initial-access-masqueraded-javascript-dropper", "reason": "Belongs to another part of the 'The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT' series.", "status": "out_of_scope" }, { "stage": "execution-silent-msi-installer", "reason": "Belongs to another part of the 'The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT' series.", "status": "out_of_scope" }, { "stage": "persistence-tampered-app-installation", "reason": "Belongs to another part of the 'The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Masqueraded JavaScript Dropper", "slug": "initial-access-masqueraded-javascript-dropper", "tactic": "initial-access", "techniques": [ "T1566.001", "T1036.007", "T1027.006" ], "observables": [ ".pdf.js", "Update_GS_7G0N-254V38L2350.zip", "Update_GS_7G0N-254V38L2350.js", "storyblok.com", "law.georgetown.edu", "search-ms:displayname=Search Results in update (\\\\us05.org@8080)" ] }, { "name": "Silent MSI Installer Execution", "slug": "execution-silent-msi-installer", "tactic": "execution", "techniques": [ "T1218.007", "T1204.002" ], "observables": [ "msiexec /i \"%TEMP%\\jn0101.msi\" /quiet /norestart", "msiexec /i \"%TEMP%\\jg0384.msi\"", "jn0101.msi", "jg0384.msi" ] }, { "name": "Tampered Application Installation", "slug": "persistence-tampered-app-installation", "tactic": "persistence", "techniques": [ "T1547.001", "T1036" ], "observables": [ "%APPDATA%\\ExdBackupTool\\", "Exodus.exe", "app.asar", "Manufacturer Apple Inc", "ProductName Background Service" ] }, { "name": "Electron UI Suppression", "slug": "defense-evasion-ui-suppression", "tactic": "defense-evasion", "techniques": [ "T1564.003", "T1027" ], "observables": [ "exodus_patch.js", "BrowserWindow.prototype.show", "BrowserWindow.prototype.focus", "BrowserWindow.prototype.center", "explorer.exe \"[INSTALLDIR]Exodus.exe\"" ] }, { "name": "Headless PowerShell Scheduled Task", "slug": "persistence-headless-scheduled-task", "tactic": "persistence", "techniques": [ "T1053.005", "T1059.001" ], "observables": [ "INetHealth", "conhost.exe --headless", "powershell -e" ] }, { "name": "C2 Network Activity", "slug": "command-and-control-network-activity", "tactic": "command-and-control", "techniques": [ "T1071.001" ], "observables": [ "35.212.159.20", "fiat.a.exodus.io", "assets-gateway-clarity-api.a.exodus.io" ] } ], "summary": "Threat actors are delivering tampered Exodus cryptocurrency wallet installers via malicious JavaScript droppers disguised as PDF documents or software updates. The malicious wallet suppresses its user interface while running a modular RAT that maintains persistence through scheduled tasks and steals browser credentials while mimicking legitimate network traffic." }, "severity": "high", "rationale": "Focus on workstations where users might manage crypto assets or open documents. Exclude servers that do not perform user-driven web activities.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has deployed a tampered Exodus wallet that suppresses its UI and maintains persistence through a headless PowerShell scheduled task while communicating with a hardcoded C2 IP.", "parameters": { "c2_ips": { "from": { "ref": "huntress-exodus-rat", "kind": "article", "observed": "2026-09-01" }, "type": "list[ip]", "default": [ "35.212.159.20" ], "description": "Hardcoded C2 IP addresses observed in the report." }, "task_names": { "from": { "ref": "huntress-exodus-rat", "kind": "article", "observed": "2026-09-01" }, "type": "list[string]", "default": [ "INetHealth" ], "description": "Names of scheduled tasks used for persistence." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat", "name": "Huntress \u2014 The Crypto Wallet That Never Opened" } ], "blind_spots": [ { "id": "no-process-visibility", "risk": "The hunt relies on file paths and parent processes because static analysis of the obfuscated JavaScript in app.asar is not performed on the endpoint.", "stage": "defense-evasion-ui-suppression", "question": "whether the BrowserWindow methods were overwritten in memory", "requires": "EDR memory-map or runtime introspection" }, { "id": "webdav-execution-gap", "risk": "If the attacker uses the us05.org WebDAV route, file creation events on the local disk are absent, leaving only network and process start events.", "stage": "command-and-control-network-activity", "question": "whether the payload was executed from a remote WebDAV share via search-ms", "requires": "hb_network_connection with WebDAV protocol details" } ] }, "name": "Tampered Exodus Wallet Persistence and C2", "description": "This hunt targets the stealthy persistence and communication phases of a modular RAT masquerading as the Exodus crypto wallet. It identifies the INetHealth scheduled task and conhost.exe headless execution patterns used to hide PowerShell scripts. It corroborates these findings by identifying rare Exodus.exe process paths in user profiles and network connections to known malicious infrastructure." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "the-crypto-wallet-that-never-opened-tampered-exodus-installer-hides-a-modular-rat", "index": 2, "title": "The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT", "total": 2 }, "coverage": [ { "stage": "defense-evasion-ui-suppression", "steps": [ "rare-exodus-paths" ], "status": "covered" }, { "stage": "persistence-headless-scheduled-task", "steps": [ "headless-powershell-tasks" ], "status": "covered" }, { "stage": "command-and-control-network-activity", "steps": [ "c2-network-traffic" ], "status": "covered" }, { "stage": "initial-access-masqueraded-javascript-dropper", "reason": "Belongs to another part of the 'The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT' series.", "status": "out_of_scope" }, { "stage": "execution-silent-msi-installer", "reason": "Belongs to another part of the 'The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT' series.", "status": "out_of_scope" }, { "stage": "persistence-tampered-app-installation", "reason": "Belongs to another part of the 'The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT' series.", "status": "out_of_scope" } ], "rationale": "An intruder has deployed a tampered Exodus wallet that suppresses its UI and maintains persistence through a headless PowerShell scheduled task while communicating with a hardcoded C2 IP.", "blind_spots": [ { "id": "no-process-visibility", "risk": "The hunt relies on file paths and parent processes because static analysis of the obfuscated JavaScript in app.asar is not performed on the endpoint.", "stage": "defense-evasion-ui-suppression", "question": "whether the BrowserWindow methods were overwritten in memory", "requires": "EDR memory-map or runtime introspection" }, { "id": "webdav-execution-gap", "risk": "If the attacker uses the us05.org WebDAV route, file creation events on the local disk are absent, leaving only network and process start events.", "stage": "command-and-control-network-activity", "question": "whether the payload was executed from a remote WebDAV share via search-ms", "requires": "hb_network_connection with WebDAV protocol details" } ], "scoping_notes": "Focus on workstations where users might manage crypto assets or open documents. Exclude servers that do not perform user-driven web activities.", "beyond_detection": "A standard rule might fire on PowerShell with an encoded command, but this hunt correlates persistence with rare application paths and network traffic, reducing noise from legitimate headless conhost use." } }, { "id": "headless-powershell-tasks", "type": "query", "label": "Headless PowerShell scheduled tasks", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (instr(',' || '{{task_names}}' || ',', ',' || job_name || ',') > 0 OR (LOWER(job_cmd_line) LIKE '%powershell%' AND LOWER(job_cmd_line) LIKE '%--headless%')) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_scheduled_job", "description": "Identify hosts where a scheduled task uses conhost to hide a PowerShell command, matching the campaign lead.", "expected_signal": "Any scheduled task using --headless with PowerShell is suspicious. Matches on INetHealth are high-confidence indicators of this campaign." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Headless PowerShell scheduled tasks", "reads": [ "device_hostname", "job_name", "job_cmd_line", "job_user_name", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE (instr(',' || '{{task_names}}' || ',', ',' || job_name || ',') > 0 OR (LOWER(job_cmd_line) LIKE '%powershell%' AND LOWER(job_cmd_line) LIKE '%--headless%')) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Any scheduled task using --headless with PowerShell is suspicious. Matches on INetHealth are high-confidence indicators of this campaign.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-exodus-paths", "type": "query", "label": "Rare Exodus paths in user profiles", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS exec_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\exdbackuptool\\exodus.exe' OR LOWER(process_path) LIKE '%\\appdata\\roaming\\exdbackuptool\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING host_count <= 5", "surface": "hb_process_activity", "description": "Find instances where Exodus.exe runs from the tampered ExdBackupTool directory and stack-count to find anomalies.", "expected_signal": "The presence of Exodus.exe in AppData\\ExdBackupTool is an anomaly. Legitimate installs typically use standard Program Files or predictable AppData paths that appear fleet-wide." }, "parents": [ { "id": "headless-powershell-tasks" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Exodus paths in user profiles", "reads": [ "device_hostname", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS exec_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_path) LIKE '%\\exdbackuptool\\exodus.exe' OR LOWER(process_path) LIKE '%\\appdata\\roaming\\exdbackuptool\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING host_count <= 5", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "The presence of Exodus.exe in AppData\\ExdBackupTool is an anomaly. Legitimate installs typically use standard Program Files or predictable AppData paths that appear fleet-wide.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "c2-network-traffic", "type": "query", "label": "Direct connections to C2 IP", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Detect network traffic from the endpoint to the hardcoded C2 infrastructure identified in the report.", "expected_signal": "Direct connections to the C2 IP from any process, especially Exodus or PowerShell, indicate active communication." }, "parents": [ { "id": "headless-powershell-tasks" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Direct connections to C2 IP", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, process_name, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Direct connections to the C2 IP from any process, especially Exodus or PowerShell, indicate active communication.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-agent", "type": "analytic", "label": "Triage wallet threat evidence", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "headless-powershell-tasks", "rare-exodus-paths", "c2-network-traffic" ], "objective": "Determine if any host shows a complete chain of headless PowerShell persistence, tampered application execution in ExdBackupTool, and communication with the malicious IP.", "description": "Evaluate whether the headless PowerShell tasks, rare application paths, and network connections confirm an active compromise.", "max_iterations": 4, "expected_signal": "A per-host verdict linking the persistence mechanism to the tampered application and C2 traffic.", "success_criteria": "Verdicts for every host with cited evidence rows." }, "parents": [ { "id": "rare-exodus-paths", "kind": "merge" }, { "id": "c2-network-traffic", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-agent verdict is malicious for at least one host", "condition": "the triage-agent verdict is malicious for at least one host", "blind_spot": "no-process-visibility", "confidence": "high", "description": "Direct the hunt to containment if the threat is confirmed or to review if findings are ambiguous.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Prevent credential exfiltration by isolating confirmed infected hosts.", "instructions": "Isolate the host from the network. Collect the %APPDATA%\\ExdBackupTool\\ directory for forensics, focusing on app.asar.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Provide a manual fallback for suspicious findings.", "instructions": "Review the scheduled tasks and process command lines for any hosts marked suspicious. Check for web browser history related to JavaScript spam as noted in the report." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record findings.", "instructions": "Document the number of hosts identified with tampered wallet installations. Recommend promoting the INetHealth task and headless PowerShell patterns to standing rules." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }