Tampered Exodus Wallet Installer Drops Modular RAT: Dll4 Suite Credential Theft Campaign — OTX Detection Pack

---
title: Trojanized Exodus Wallet MSI Installation
id: 9a1f2c3d-4e5b-6a7c-8d9e-0f1a2b3c4d01
status: experimental
description: Detects MSI-based installation of Exodus wallet software, which in this campaign delivers a tampered installer containing the Dll4 modular RAT alongside legitimate Exodus v24.33.4
references:
    - https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat
author: Security Arsenal Threat Intel
date: 2026/09/03
tags:
    - attack.initial_access
    - attack.t1195
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
    service: sysmon
detection:
    selection_msiexec:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains:
            - 'exodus'
    selection_js_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection_msiexec and selection_js_parent
falsepositives:
    - Enterprise software distribution of Exodus (rare outside crypto-native firms)
level: high
---
title: Dll4 Modular RAT C2 via Azure Table Storage
id: 9a1f2c3d-4e5b-6a7c-8d9e-0f1a2b3c4d02
status: experimental
description: Detects non-browser, non-Azure-application processes establishing connections to Azure Table Storage endpoints, matching the Dll4 RAT's living-off-trusted-cloud C2 channel
references:
    - https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat
author: Security Arsenal Threat Intel
date: 2026/09/03
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection_destination:
        DestinationHostname|endswith: '.table.core.windows.net'
    filter_legitimate:
        Image|endswith:
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\AzureStorageExplorer.exe'
            - '\azcopy.exe'
    condition: selection_destination and not filter_legitimate
falsepositives:
    - Custom enterprise applications using Azure Table Storage SDKs
    - PowerShell scripts using Az.Storage module
level: medium
---
title: Dll4 Campaign Infrastructure Domain Resolution
id: 9a1f2c3d-4e5b-6a7c-8d9e-0f1a2b3c4d03
status: experimental
description: Detects DNS resolution of infrastructure associated with the tampered Exodus installer / Dll4 modular RAT campaign
references:
    - https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat
author: Security Arsenal Threat Intel
date: 2026/09/03
tags:
    - attack.command_and_control
    - attack.t1071.004
logsource:
    category: dns
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'us05.org'
    condition: selection
falsepositives:
    - None expected for this indicator
level: critical

// Hunt: Tampered Exodus installer + Dll4 modular RAT behaviors
// Covers: JS-dropper-launched MSI, Exodus installs with anomalous provenance,
// Azure Table Storage C2 from unexpected processes, and campaign domain hits.
let CampaignHashes = dynamic([
    "2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d",
    "5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603",
    "5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a",
    "7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8",
    "84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756",
    "8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a",
    "c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485"
]);
let Lookback = 90d;
let JsMsi =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName =~ "msiexec.exe"
    | where ProcessCommandLine has_any ("exodus")
       or (InitiatingProcessFileName in~ ("wscript.exe","cscript.exe") and ProcessCommandLine has ".msi")
    | project JsMsiTime=TimeGenerated, DeviceId, DeviceName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
let HashHits =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in~ (CampaignHashes)
    | project HashTime=TimeGenerated, DeviceId, DeviceName, FileName, FolderPath, SHA256;
let AzureTableC2 =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl endswith ".table.core.windows.net"
    | where InitiatingProcessFileName !in~ ("msedge.exe","chrome.exe","firefox.exe","azcopy.exe","AzureStorageExplorer.exe","powershell.exe")
    | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP;
let DomainHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has "us05.org"
    | project DomainTime=TimeGenerated, DeviceId, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP;
JsMsi
| union HashHits, DomainHits
| union (AzureTableC2 | project DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP, Connections, FirstSeen, LastSeen)
| sort by DeviceName asc

# Dll4 Modular RAT / Tampered Exodus Installer - Host Hunt Script
# Run via your RMM/EDR remote shell or as an Intune remediation detection script
# Requires: elevated privileges for full artifact coverage

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

Write-Host "[1/5] Checking for Exodus installation with tampered file provenance..."
$exodusPaths = @(
    "$env:LOCALAPPDATA\exodus",
    "$env:ProgramFiles\Exodus",
    "${env:ProgramFiles(x86)}\Exodus"
)
foreach ($path in $exodusPaths) {
    if (Test-Path $path) {
        $findings += [pscustomobject]@{Check='ExodusInstallPath'; Artifact=$path; Detail='Exodus installation present - verify version and file signatures against official 24.33.4 release'}
        Get-ChildItem $path -Recurse -Include *.dll,*.exe | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            if ($sig.Status -ne 'Valid') {
                $findings += [pscustomobject]@{Check='UnsignedOrTamperedBinary'; Artifact=$_.FullName; Detail="Signature status: $($sig.Status)"}
            }
        }
    }
}

Write-Host "[2/5] Hunting for Dll4 module artifacts on disk..."
$dll4Names = @('dll4_cmd','dll4_fileman','dll4_browser','dll4_socks','dll4_vnc','dll4_script')
$searchRoots = @($env:TEMP, $env:APPDATA, $env:LOCALAPPDATA, $env:ProgramData)
foreach ($root in $searchRoots) {
    foreach ($mod in $dll4Names) {
        Get-ChildItem $root -Recurse -Filter "*$mod*" -ErrorAction SilentlyContinue | ForEach-Object {
            $findings += [pscustomobject]@{Check='Dll4ModuleFile'; Artifact=$_.FullName; Detail="Size: $($_.Length) bytes; Created: $($_.CreationTime)"}
        }
    }
}

Write-Host "[3/5] Checking campaign file hashes..."
$maliciousHashes = @(
    '2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d',
    '5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603',
    '5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a',
    '7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8',
    '84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756',
    '8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a',
    'c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485'
)
Get-ChildItem $env:TEMP, "$env:USERPROFILE\Downloads" -Recurse -Include *.msi,*.js,*.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($maliciousHashes -contains $h) {
        $findings += [pscustomobject]@{Check='MaliciousHashMatch'; Artifact=$_.FullName; Detail="SHA256: $h"}
    }
}

Write-Host "[4/5] Checking active connections to campaign infra and Azure Table Storage..."
Get-NetTCPConnection -State Established | Where-Object {
    $_.RemotePort -eq 443
} | ForEach-Object {
    try {
        $resolved = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost
        if ($resolved -match 'us05\.org' -or $resolved -match '\.table\.core\.windows\.net$') {
            $proc = Get-Process -Id $_.OwningProcess
            $findings += [pscustomobject]@{Check='SuspiciousNetworkConnection'; Artifact=$resolved; Detail="Process: $($proc.ProcessName) ($($proc.Path)) -> $($_.RemoteAddress):443"}
        }
    } catch {}
}

Write-Host "[5/5] Reviewing persistence via scheduled tasks and Run keys referencing Exodus/JS..."
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'exodus|wscript|cscript' } | ForEach-Object {
    $findings += [pscustomobject]@{Check='SuspiciousScheduledTask'; Artifact=$_.TaskName; Detail="Action: $($_.Actions.Execute) $($_.Actions.Arguments)"}
}
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    (Get-ItemProperty $key).PSObject.Properties | Where-Object { $_.Value -match 'exodus|\.js' } | ForEach-Object {
        $findings += [pscustomobject]@{Check='SuspiciousRunKey'; Artifact="$key\$($_.Name)"; Detail=$_.Value}
    }
}

Write-Host "`n===== HUNT RESULTS ====="
if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path "$env:TEMP\dll4_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) finding(s) - results exported to TEMP. Escalate to IR immediately."
} else {
    Write-Host "[+] No indicators of Dll4 modular RAT compromise found on this host."
}