The installer keeps its promise. Exodus Wallet 24.33.4 lands on disk, and the same package then works to make sure the victim never opens it [1]. Any check that asks whether a download delivered the software it advertised returns a clean answer here. The wallet is the receipt. The modular RAT going after browser credentials is the reason the package exists [16].
Huntress dates the build to the day before the August 18 cluster [3], which puts compile to three separate victim estates inside 48 hours [17]. Within that window the three organisations sit about 42 minutes apart [18]. That spacing reads as one delivery run against a target list rather than drift from a wider spray.
The July 24 endpoint is where the investigation turned. There was no lure document. A scheduled task called INetHealth launched conhost.exe --headless powershell -e with a Base64 blob, on a machine that was infected before it was enrolled for monitoring [5]. Huntress read it as ClickFix at first [6]. The artifact is weak evidence: conhost --headless hides a window, it is a legitimate Windows function developers use, and it says nothing about how the command reached the host [7]. Decoding the blob showed it downloaded nothing at all, and that dead end is what Huntress calls the most useful clue in the case [8].
Two artifacts survive on disk and are cheap to hunt. The JavaScript tries to remove the dropper five seconds after launch using setTimeout, which Windows Script Host does not implement, so the call throws into an empty catch block and jn0101.msi stays in %TEMP% [13]. On the archive route, the user opened a .js file directly inside Update_GS_7G0N-254V38L2350.zip instead of extracting it, and Explorer's staging behaviour left a .zip.116 path fragment under %LOCALAPPDATA%\Temp [14].
The lures show preparation rather than volume. One victim got a real marketing ebook from a content platform; another got a genuine legal brief pulled live from law.georgetown.edu [12]. Both arrived while the MSI downloaded in the background [11]. The double-extension variant relied on Windows hiding known extensions, so a .pdf.js file looked like a document and ran under Windows Script Host when opened [9]. On two endpoints the parent process was chrome.exe, so the file executed straight out of the browser download flow with no save-and-inspect step in between [10].
Huntress states that the two delivery routes it observed should not be read as the actor's full inventory [15]. Detection content keyed to .pdf.js and one zip filename will hold for exactly as long as the operator keeps using them. The durable indicators in this set are the surviving dropper in %TEMP%, the Explorer staging fragment, and a wallet application that is installed and never run.
