EtherRAT Uses Ethereum Smart Contracts for C2 and Collects Extensive Host Data

Mar 27, 2026 · Original article ↗

Summary

eSentire analyzed EtherRAT, a Node.js backdoor found at a retail customer in March 2026. It retrieves C2 addresses from Ethereum contracts, uses CDN-like HTTPS beacons, and runs a SYS_INFO module for host fingerprinting.

Key points

eSentire TRU detected EtherRAT in a retail customer environment in March 2026; its analysts isolated the affected host and supported remediation.
In the observed case, ClickFix used pcalua.exe to launch mshta.exe and retrieve a malicious HTA; other EtherRAT incidents used Microsoft Teams IT Support scams and QuickAssist.
The malware uses AES-256-CBC across staged Node.js payloads, Obfuscator.io obfuscation, and an HKCU Run key for persistence, with conhost.exe proxying node.exe.
EtherRAT queries Ethereum RPC providers for C2 addresses stored in a smart contract; setString events can update those addresses.
The backdoor polls C2 over HTTPS using CDN-like URL patterns, supports remote command execution, and can send its source code to C2 for reobfuscation.
A C2-delivered SYS_INFO module collects extensive host, user, operating-system, network, and security-product details; it exits if it detects specified CIS-region languages.
The article says EtherRAT can steal cryptocurrency wallets and cloud credentials and was reportedly linked by Sysdig to a North Korean APT through overlaps with Contagious Interview tactics.

Article Details

Attack Vectors: In the observed case, ClickFix used pcalua.exe to launch mshta.exe and retrieve the malicious shep.hta file from a compromised website.
TRU reports that IT Support scams over Microsoft Teams, followed by QuickAssist remote access, occur in many other EtherRAT incidents.
The malware stages decrypt Node.js code and execute it; the later stage writes and launches EtherRAT, which can execute commands, collect host information, and steal assets including cryptocurrency wallets and cloud credentials.
EtherRAT establishes persistence with an HKCU Run value that uses conhost.exe to proxy-execute node.exe. It retrieves C2 addresses from Ethereum smart-contract data and polls C2 over HTTPS using CDN-like URLs.
A C2-delivered SYS_INFO module checks for specified CIS-region languages and, if one matches, deletes itself and exits; otherwise, it collects extensive system and security-software information.
Defensive Notes: eSentire recommends disabling mshta.exe and pcalua.exe through AppLocker Group Policy or Windows Defender Application Control.
eSentire recommends disabling the Run prompt through Group Policy and providing phishing and security-awareness training that covers ClickFix and IT Support scams.
eSentire recommends blocking crypto-network RPC providers used by threat actors for payload staging.
eSentire's SOC analysts isolated the affected host; the team also reported ongoing monitoring of EtherRAT campaigns and development of detection content.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`aurineuroth[.]com`	EtherRAT C2 domain observed returning the SYS_INFO module.
DOMAIN	`euclidrent[.]com`	Listed as an EtherRAT C2 domain.
DOMAIN	`hayesmed[.]com`	Listed as an EtherRAT C2 domain.
DOMAIN	`jariosos[.]com`	Listed as an EtherRAT C2 domain.
DOMAIN	`justtalken[.]com`	Listed as an EtherRAT C2 domain.
DOMAIN	`mebeliotmasiv[.]com`	Listed as an EtherRAT C2 domain.
DOMAIN	`o-parana[.]com`	Listed as an EtherRAT C2 domain.
DOMAIN	`palshona[.]com`	Listed as an EtherRAT C2 domain.
DOMAIN	`regancontrols[.]com`	Listed as an EtherRAT C2 domain.
DOMAIN	`salinasrent[.]com`	Listed as an EtherRAT C2 domain.
IPV4	`185[.]218[.]19[.]162`	C2 IP address associated with aurineuroth.com.
SHA256	`03c4e54cc775ab819752dc5d420ab2fed03bd445c3ce398d021031100b334fb4`	Hash of deobfuscated EtherRAT.
SHA256	`294c597c89023093e1e175949f5104f887b89cd8e1cf1d3192ee9032739f259e`	Hash of the EtherRAT MSI loader.
SHA256	`2edf1ab615b489e228a89c617d24f66d1e780a6d5e30f6886608dfe79325acf8`	Hash of the EtherRAT HTA script shep.hta.
SHA256	`47f74749cfcd55c8dacde2cc9b4c45282bec7a93ee19b7b81b452c99758d3370`	Hash of obfuscated EtherRAT stage 2.
SHA256	`5623f4f8942872b2b7cb6d2674c126a42bdf6ed5d1f37c1afc348529e4697d73`	Hash of EtherRAT stage 1.
SHA256	`7dd1bf7a58774a081062f5c8f183d24f95c433805e0bf73280c0adba1c71390d`	Hash of obfuscated EtherRAT.
SHA256	`83b1f11c6a0bd267e415136440559131d2d4ace9a65dc221ea3b144fe0e7199b`	Hash of the EtherRAT SYS_INFO module.
SHA256	`b1ee812e7c786c8696f913595658e57706d97a66ca7b7634f421f5c552e7002b`	Hash of deobfuscated EtherRAT stage 2.
URL	`hxxps[:]//aurineuroth[.]com/api/5f459179/29e96c95-62a5-49e5-a8ba-7ebfbf560ab7/b435a6b1.ico?b=9e2f9c07-f85a-4089-8669-186f56bca7b3`	EtherRAT HTTPS beacon URL used to communicate with C2.
URL	`hxxps[:]//www-flow-submission-management[.]shepherdsestates[.]uk/shep.hta`	Malicious HTA delivery URL hosted on a website identified as compromised.