Researchers Detail EtherRAT’s Multi-Stage Loaders and Ethereum-Based C2
Summary
Researchers traced EtherRAT through MSI and PowerShell loaders to a broader infrastructure hosting malware and phishing pages. The Node.js RAT uses Ethereum smart-contract queries to resolve C2 and can execute attacker-supplied JavaScript.
Key points
- EtherRAT was distributed through MSI installers and PowerShell scripts hosted in open directories.
- The MSI chain used BAT and JScript loaders, custom decryption, and registry-based persistence to execute the RAT.
- The Node.js RAT queries an Ethereum smart contract to retrieve its active C2 URL, which the researchers say can make takedowns harder.
- EtherRAT can execute JavaScript received from C2, modify files and registry settings, and exfiltrate data.
- After startup, the RAT sends its source code to C2 and receives a newly obfuscated script that is written back to disk.
- Related infrastructure also hosted phishing pages, malicious documents, remote-control software, and exposed phishing-kit files.
Article Details
- Attack Vectors
- MSI installers and PowerShell scripts distributed from an /install directory delivered EtherRAT through staged BAT, JScript, and encrypted-payload loaders.
- The loaders downloaded Node.js when it was absent, decrypted the EtherRAT payload, and executed it.
- Phishing campaigns began with email attachments, including PDF or Excel documents that prompted recipients to follow a link to another document.
- Phishing pages requested email addresses and could continue the infection chain by serving phishing or malware pages.
- EtherRAT retrieved its active C2 URL through an Ethereum smart-contract query and could execute JavaScript returned by its C2 server.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aravisblog[.]com | Identified as EtherRAT C2 infrastructure. |
| DOMAIN | bi[.]mkrjcsw[.]com | EtherRAT distribution domain identified in the article. |
| DOMAIN | cambioefectivo[.]com | Identified as EtherRAT C2 infrastructure. |
| DOMAIN | dn[.]eyqwj[.]com | EtherRAT distribution domain identified in the article. |
| DOMAIN | dorqen[.]casa | EtherRAT distribution domain identified in the article. |
| DOMAIN | ivorilla[.]cloud | EtherRAT distribution domain identified in the article. |
| DOMAIN | kelvra[.]club | EtherRAT distribution domain identified in the article. |
| DOMAIN | kibrisarazi[.]com | Identified as EtherRAT C2 infrastructure. |
| DOMAIN | mx[.]nrlwz[.]com | EtherRAT distribution domain identified in the article. |
| DOMAIN | publicspeakingtip[.]org | Identified as EtherRAT C2 infrastructure. |
| DOMAIN | tranzed[.]org | Identified as EtherRAT C2 infrastructure. |
| DOMAIN | vabelles[.]com | Identified as EtherRAT C2 infrastructure. |
| IPV4 | 159[.]89[.]227[.]204 | Identified in the article as malicious infrastructure. |
| IPV4 | 185[.]221[.]216[.]121 | Identified in the article as malicious infrastructure associated with EtherRAT. |
| IPV4 | 40[.]160[.]238[.]30 | Identified in the article as malicious infrastructure. |
| IPV4 | 43[.]163[.]233[.]166 | Identified in the article as malicious infrastructure. |
| IPV4 | 57[.]128[.]31[.]168 | Identified in the article as malicious infrastructure. |
| IPV4 | 82[.]165[.]65[.]244 | Identified in the article as malicious infrastructure associated with EtherRAT. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe BAT, JScript, and EtherRAT payloads were obfuscated, and the loaders decrypted embedded code before execution.T1041 · Exfiltration Over C2 ChannelEtherRAT sent its source code to the C2 server and received a re-obfuscated script in response.T1059.001 · PowerShellPowerShell scripts were used to deliver EtherRAT, and post-execution commands queried host information.T1059.003 · Windows Command ShellThe MSI chain launched a BAT script through cmd.exe to run infection stages.T1059.007 · JavaScriptEtherRAT executed arbitrary JavaScript code returned by its C2 server.T1082 · System Information DiscoveryPost-compromise commands queried the GPU, MachineGuid, and computer-system information.T1105 · Ingress Tool TransferThe loader downloaded Node.js when it was not installed, using curl to fetch it from the official website.T1140 · Deobfuscate/Decode Files or InformationLoaders used XOR-based and custom decoding routines to decrypt embedded code and the EtherRAT payload.T1547 · Boot or Logon Autostart ExecutionThe decrypted loader added a registry key for persistence.