StepDrainer and EtherRAT Illustrate Convergence of Crypto Drainers and Traditional Malware

Apr 23, 2026 · Original article ↗

Summary

LevelBlue analyzes StepDrainer and EtherRAT, detailing how wallet-phishing drainers and a trojanized Windows installer combine crypto-focused operations with traditional malware techniques, including obfuscated payload delivery, on-chain configuration, and persistence.

Key points

The report describes StepDrainer as a multichain drainer-as-a-service targeting more than 20 networks and using convincing wallet interfaces to prompt users to connect or approve transactions.
StepDrainer’s reported theft methods include prioritizing valuable assets and targeting NFTs, ETH, and ERC-20 tokens through Seaport, permit signatures, or token approvals.
LevelBlue traced StepDrainer stager infrastructure across more than 3,000 domains, with randomized PHP backends, dynamically injected JavaScript, and obfuscated payloads.
The investigation found a Solana account used to store campaign configuration and describe how the stager retrieves infrastructure details through blockchain RPC requests.
EtherRAT was delivered in a trojanized Tftpd64 installer from a malicious GitHub repository, with an embedded Node.js runtime and an obfuscated implant.
The analyzed EtherRAT sample established persistence through a Windows Run key, performed hidden PowerShell reconnaissance, and contacted Ethereum RPC endpoints; the report says direct draining was not observed in this sample.

Article Details

Attack Vectors: High-fidelity trading, compliance, and AI-themed phishing pages impersonate legitimate platforms and prompt victims to connect wallets.
StepDrainer uses deceptive wallet modals and transaction prompts to obtain approvals or signatures, then transfers cryptocurrency and NFTs.
StepDrainer injects JavaScript into webpages and retrieves obfuscated next-stage code through stager APIs and randomized PHP endpoints.
EtherRAT is distributed in a trojanized Tftpd64 MSI or ZIP offered through a malicious GitHub repository impersonating the official project.
EtherRAT uses a bundled Node.js runtime, an obfuscated .dat payload, and PowerShell commands for host reconnaissance.
Defensive Notes: Treat wallet warnings and transaction approval requests cautiously; verify what an approval or signature authorizes before proceeding.
Verify administrative-software downloads through trusted project distribution channels, since the article describes a malicious repository impersonating the Tftpd64 project.
Include drainer behavior in organizational threat models and apply visibility and controls comparable to those used against credential-stealing malware.
Monitor for unexpected Windows Run-key persistence, concealed PowerShell reconnaissance, and unusual Node.js execution associated with downloaded installers.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`8kwfaa30jtlnwi[.]com`	Attacker-controlled fallback C2 domain revealed by the StepDrainer API and associated with its backend infrastructure.
DOMAIN	`scanclaw[.]live`	Malicious OpenClaw-style landing page used to lure users into the StepDrainer wallet-connection flow.
DOMAIN	`wpuadmin[.]shop`	Domain contacted by EtherRAT and listed among the campaign's C2/backend and staging infrastructure.