# EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation

> Malwarebytes uncovered a sprawling malicious infrastructure distributing EtherRAT, a Node.js-based remote access trojan, alongside phishing pages and additional malware via open directories and compromised websites. EtherRAT resolves its command-and-control endpoints from a smart contract on the Ethereum blockchain (resistant to takedowns) and receives freshly obfuscated builds from C2 on each execution, defeating hash-based detection.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-09-27T02:36:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0814
- **ID:** TL-2026-0814
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EtherRAT is a remote access trojan written in Node.js that grants an operator complete control of an infected Windows host and the ability to execute arbitrary JavaScript returned by its command-and-control (C2) servers. Malwarebytes documented the malware as one payload of a broad malicious infrastructure that also serves phishing kits and other malware through open directories and compromised legitimate websites.

The infection chain begins on distribution websites that deliver either MSI installers (observed versions v1.msi through v10.msi) or PowerShell scripts (v*.ps1 variants). On execution, a BAT launcher (e.g. KmPuGimn.cmd) extracts components into a randomly named folder under %LOCALAPPDATA%. If Node.js is not already present, it is downloaded from official sources and extracted to a renamed subdirectory (observed as '28Q75h'); a copy of node.exe is staged for persistence as _MJlLlt5.exe. A JScript loader (cDQMlQAru0.xml) decrypts the encrypted EtherRAT payload (MRaQCipBIZeiZNx.log) using a custom XOR-based stream-decoding routine that employs byte rotations and accumulators. EtherRAT then establishes persistence by adding a registry run key that launches the staged Node copy via 'conhost.exe --headless' to suppress a visible window.

The defining trait of EtherRAT is its blockchain-based C2 resolution. Rather than hard-coding C2 addresses, the malware issues an eth_call JSON-RPC request to read the Ethereum smart contract at 0x88ea8d0bc4146f0a018e989df3fd089ac48f9a58, invoking function selector 0x7d434425 with argument 0xf6a772e163e64b07f658946f863b5d457d88f9f0. The contract returns the active C2 endpoint(s). Because the lookup is performed against public Ethereum RPC gateways (mainnet.gateway.tenderly.co, rpc.flashbots.net/fast, rpc.mevblocker.io, eth-mainnet.public.blastapi.io, ethereum-rpc.publicnode.com, eth.drpc.org, eth.merkle.io), the resolution channel blends into legitimate Web3 traffic and cannot be sinkholed or seized like ordinary DNS infrastructure; operators rotate C2 simply by updating contract state.

Once connected, EtherRAT performs environment reconnaissance — enumerating GPU, domain membership, and administrative status — and supports file and folder operations, registry modification, and arbitrary JavaScript execution. Collected data is written to a local log named svchost.log (a masquerade) prior to exfiltration to C2. Critically, EtherRAT supports self-reobfuscation: on each execution it can fetch a newly obfuscated build from C2, so its on-disk hash changes every run, neutralizing signature- and hash-based detection.

The surrounding infrastructure also hosts phishing pages (endpoints such as /zht/sharep-redirect.html, /bl/me.php, /t/teams, /teams/Windows/invite.php) that impersonate Microsoft Teams / SharePoint and harvest victim email addresses to advance the infection chain. Misconfigured open directories on the same servers exposed the phishing-kit source code, including a 'cl.zip' archive containing a 'URL Cloaker' page used to evade automated analysis. No CVE is associated with this campaign; severity is HIGH given full machine-compromise capability combined with takedown-resistant, detection-evading design.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1569.002 Service Execution
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1218.007 System Binary Proxy Execution: Msiexec
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1102 Web Service
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1056 Input Capture

## Sources

- [Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software](https://www.malwarebytes.com/blog/threat-intel/2026/06/inside-a-malicious-infrastructure-delivering-etherrat-phishing-pages-and-malicious-software)
- [MITRE ATT&CK T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
- [MITRE ATT&CK T1102 — Web Service (dead-drop / C2 resolution)](https://attack.mitre.org/techniques/T1102/)
- [MITRE ATT&CK T1027 — Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/)
- [MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript](https://attack.mitre.org/techniques/T1059/007/)
- [MITRE ATT&CK T1566 — Phishing](https://attack.mitre.org/techniques/T1566/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0814