A tampered Exodus Wallet 24.33.4 installer delivers a modular RAT while installing a functional but UI-suppressed wallet. The RAT uses memory-resident reflective PE loading via JavaScript FFI using the koffi library, with an AES-256-CBC encrypted 10 MB payload. C2 runs over Azure Table Storage as a dead drop mechanism. Six plugin DLLs provide remote command execution, file management, browser credential and cookie theft, SOCKS proxy, hidden VNC, and LuaJIT script execution. Persistence is maintained via Task Scheduler COM API with an INetHealth task clearing proxy settings to ensure direct C2 egress.
reflective PE loading
1 post
The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT