SharkStealer Using EtherHiding Pattern to Resolves Communications With C2 Channels
An advanced information-stealing malware, developed using Golang, has been identified. This malware utilizes blockchain technology to create concealed command-and-control (C2) channels.
An advanced information-stealing malware, developed using Golang, has been identified. This malware utilizes blockchain technology to create concealed command-and-control (C2) channels.
Named SharkStealer, the malware employs the BNB Smart Chain Testnet as a robust dead-drop resolver for its C2 infrastructure.
This approach highlights the use of Web3 technologies by threat actors to bypass traditional detection measures and maintain persistent communication channels.
SharkStealer adopts a unique technique called EtherHiding, storing critical components of the infection chain on public blockchains instead of conventional web servers.
This method leverages immutable blockchain networks to create a censorship-resistant infrastructure that is difficult for defenders to disrupt or monitor.
By embedding C2 addresses within smart contract responses, SharkStealer establishes a distributed communication layer that remains functional even if traditional domains or IP addresses are blocked.
The malware's attack vector focuses on the transparency and accessibility of public blockchain networks while ensuring operational security through encryption.
An advanced information-stealing malware, developed using Golang, has been identified.
Analysts have identified that the malware issues Ethereum RPC eth_call requests to specific smart contracts deployed on the BSC Testnet nodes.
These contracts act as encrypted data repositories, returning tuples containing an initialization vector (IV) and encrypted payload upon query.
The malware decrypts this data using a hardcoded AES-CFB key within the binary, ultimately revealing the actual C2 server addresses.
The infection mechanism involves a multi-stage process starting with establishing a secure connection to the BSC Testnet RPC endpoint at data-seed-prebsc-2-s1.binance.org:8545.
The following code snippet illustrates how SharkStealer constructs the JSON-RPC request:
v87.Jsonrpc.ptr = "2.0"; v87.Method.ptr = "eth_call"; v77.To.ptr = "0x3dd7a9c28cfedf1c462581eb7150212bcf3f9edf"; v77.Data.ptr = "0x24c12bf6";
The C2 resolution mechanism of the malware demonstrates sophisticated engineering by combining blockchain interaction with traditional cryptographic techniques .
Upon reaching target smart contract addresses, specifically 0xc2c25784E78AeE4C2Cb16d40358632Ed27eeaF8E and 0x3dd7a9c28cfedf1c462581eb7150212bcf3f9edf, the contracts execute function 0x24c12bf6, returning encrypted C2 data.
The decryption process employs AES-CFB mode, using the hardcoded key and dynamically retrieved IV to decrypt the payload.
Analysis of the sample SHA-256 hash 3d54cbbab911d09ecaec19acb292e476b0073d14e227d79919740511109d9274 revealed active C2 servers at 84.54.44.48 and securemetricsapi.live, indicating the technique's operational effectiveness.
Based on reporting by Cyber Security News.