Etherhiding: Hunting and Prevention | IFIN

General
1

by Michael Taggart

Cryptocurrency and malware: a match made in heaven. Let's learn how to read the ledger and extract malware config.

This is a companion discussion topic for the original entry at https://ifin-intel.org/blog/etherhiding/
3

I have an expansion of my f-crypto block list the article links to. Some of them are still completely active, albeit a bit unreliable, and many have goodbye pages or now defunct.

I don’t really trust the “defunct” to stay that way or who knows what’ll pick it up when they expire. So I’ll probably split them within the file of longer operational (no regret block list) vs something you may hunt on in the active list—I’m focusing on the RPC nodes in particular.

I’ll try to get that updated next week.

4

EtherHiding & ClickFix

I could not find a good overview of addresses that can be tied to malicious purposes, so I created my own. Some are reported on before, others were found in ClickFix campaigns.

While researching this I also came across a GitHub repository by BlueTeamCoolTeam and related blogpost by Luke Wilkinson who tried to map all known EtherHiding campaigns.

Polygon 0x08207b087f61d7e95e441e15fd6d40befd6ed308 “Analytics” ErrTraffic

Since March 11, 2026, the Polygon address 0x08207b087f61d7e95e441e15fd6d40befd6ed308 has created over 15 smart contracts that host domains that are used in the latest ErrTraffic campaigns.

Source: Err-Hiding and Seek: How ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign | levelblue.com

The “Analytics” ErrTraffic cluster, previously documented by LevelBlue and other threat reports, relies on the Polygon blockchain and the cryptocurrency wallet address 0x08207B087F61d7e95E441E15fd6d40BEfd6eD308 to retrieve the C2 domains and fetch Vidar infostealer payloads during April and May 2026.

Source: Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework | sekoia.com

Polygon 0x5db7412c80269c3929a380d8b90b62d96a765e5a ErrTraffic

Created multiple contracts with what looks like ErrTraffic communication patterns.
First activity: 2026-04-03 18:39:59Z. Last activity: 2026-05-16 20:43:36Z.

Contracts/StorageDomains: 0xcdcb5202eb1113f268be3a7d539b2d00ea32e533, 0x09fec98ebea568b5adbfaddd037eaa14c3f970c8, 0x4b411c4adf2ccd1f19549cc7283961bdc030f963, 0xa27f4e3170d52413dc588bc76ea603c3ff1dba62, 0x5a901b8d2ad9665c06a9c80117252b1c48786eee, 0xf0cc93ff08f5462aaa2a0612dc6af14779041bef, 0xe576897f13ea261c7b686489fb1b35c8d806884e, 0xe12894c1efab3551a93c6f65ef13a82da28723da, 0xcb183180e566f5b6f003fe3832b511595b2ce5cb, 0xf50c07986e9a9d96743aac66f4da8788d3f32ecc.

Polygon 0xcdcb5202eb1113f268be3a7d539b2d00ea32e533

The content is not obfuscated and does not contain Javascript but a C2 domain.
There is a single domain transaction setText with content tofartinthesummer.com on 2026-04-05 04:40:09 UTC.

Based on historic observations on URLScan.io, the URL https://tofartinthesummer.com/api/css.js?b=c640b5df&r=854220 returned obfuscated Javascript with characteristic if(window.TextDecoder){try{return new TextDecoder("utf-8").decode(arr);}catch(e){}}var tmp=. A second request to https://tofartinthesummer.com/api/index.php?q=ww0mC8lsqy6jBeXOuQ returned a JSON object with "enc":"gcm1" and keys q and q2. This is backend communication is identical to ErrTraffic as described by LevelBlue.

Polygon 0x09fec98ebea568b5adbfaddd037eaa14c3f970c8

The content is not obfuscated and does not contain Javascript but a C2 domain.
There is a single domain transaction setText with content tofartinthesummer.com on 2026-04-05 21:43:09 UTC.

Polygon 0xe12894c1efab3551a93c6f65ef13a82da28723da

There are no transactions with this “StorageDomain” contract that allows to set/get a domainname.
The default contact is https://nevertiredflowers.lol.
Created on 2026-04-19 11:18:20.

Polygon 0xcb183180e566f5b6f003fe3832b511595b2ce5cb

There are no transactions with this “StorageDomain” contract that allows to set/get a domainname.
The default contact is http://46.226.163.128 (AS210644, Aeza Group LLC).
Created on 2026-05-08 09:58:10.

Polygon 0xf50c07986e9a9d96743aac66f4da8788d3f32ecc

There are no transactions with this “StorageDomain” contract that allows to set/get a domainname.
The default contact is https://bigflopenergy.com.
Created on 2026-05-16 20:43:36.

Polygon 0xcaf2c54e400437da717cf215181b170f65187abf

First activity on 2024-10-17 11:09:36. This contact is still active, with recent activity on 2026-07-17 13:14:42.

This is the contract creator for multiple contracts and domain updates.

Polygon 0xb36482fe794b895695914779db3909b471d1aa43 “Bintang” ErrTraffic

This contract does not obfuscate the content and stores a URL. Function name: newDomain.
Observed entries: https://mrllvd.beer (2026-03-12 1:55:39) and https://cloud-safe.click (2026-03-12 8:57:37)

We dubbed this campaign “Bintang”, after the popular Indonesian beer to reflect the link between the “Beer” cluster and Indonesian patterns identified within the operator’s toolkit.

Source: Unveiling ErrTraffic: inside a growing ClickFix malware distribution framework | sekoia.com

BSC testnet contact 0xa1decfb75c8c0ca28c10517ce56b710baf727d2e

Relates to ClearFake according to LevelBlue.

5

Etherium La02-loader cluster

  • 0x9A4752cAA1C15868487A0ACb691F81bfA901E063: First activity on Invalid date.
  • 0x839d1cE5c3F259e8d3D17114d7186EDabdbeA94b: First activity on Invalid date.
  • 0x6d2c5435EF70196740a48904B69377935D50abBB: First activity on Invalid date.

As reported by PGrass on the malicious Wordpress plugin “Delta Tracker Fix” VirusTotal. The smart contract data payload is XOR encoded, with the first byte as the key length, then X bytes the key followed by the rest of the bytes as XOR encoded text. Decoded it reveals (up to) three unique URL’s.

The interesting part related to EtherHiding is that the RPC calls are made serve-side instead of client-side. For example ErrTraffic and ClearFake use client-side calls. This neutralises detective and preventive measures related to web browser traffic towards RPC nodes.

EDIT: Clarified the decoding method.

6

Polygon Aeternum botnet cluster

Contract address Comment
0x04E25a563f159308FC3E15fE9Ccc9D2CF623D0cc Sample 1 Polygon smart contract address
0x16dA95799CB8aB203f83e01AFC030B1217198Da4 Sample 1 Polygon smart contract address
0x1D50703722729dD68e89D819F69eFc5Fb206bBe7 Sample 1 Polygon smart contract address
0x27c7c36981c1ed5cFA2DCDb4B43C27A6BaF6bEa8 Sample 1 Polygon smart contract address
0x4dcE7d4b1229F3705BDB70341484cF2EEE36432e Sample 1 Polygon smart contract address
0x55b4F951d5Ac035C21B170C73C0A930a641b718C Sample 1 Polygon smart contract address
0x6da31EB2A016074ffd5519326573E78E2677E4C8 Sample 1 Polygon smart contract address
0x737791081A398151195a753Fb49f9c1b8bc1fCDB Sample 1 Polygon smart contract address
0x7D2D8A4A6E8D89cf5C151C4f68A521490D9779B0 Sample 1 Polygon smart contract address
0x8d2BaEc2687F59eE1EE7BFd322D33325f5E004ee Sample 1 Polygon smart contract address
0xb3EF2D08Bf25a7daB9d8b98d64E564eA1f6Db924 Sample 1 Polygon smart contract address
0xb8fB2bfb182A172b29C365AD6CF743449975C418 Sample 1 Polygon smart contract address
0xbD6e817Cc510EC3DA5651B5a3AC595d34C0CF1af Sample 1 Polygon smart contract address
0xC37fB924cF5996C9e676BBA399bDfc5F936B3572 Sample 1 Polygon smart contract address
0xC41342908f98E813862EDFe47Ac3af676F8098C9 Sample 1 Polygon smart contract address
0xc7199C1dbCd82c4E002327Aa3EC9158F434a6aCE Sample 1 Polygon smart contract address
0xCE476E6f4d83a7a086Cbcdf0FE2E8f221e47e81C Sample 1 Polygon smart contract address
0xD69A36439FffD145ADAcacB94fDe6f8b3546a361 Sample 1 Polygon smart contract address
0xf9438b4E3200AE1611eD3d03310c803FDdf67672 Sample 1 Polygon smart contract address
0xfbC267200f9e5749045f32dbB55BB16615f1CE5F Sample 1 Polygon smart contract address
0xFDB8b139EeacD17ea7c10c256eA77Ba6Dff18D7d Sample 1 Polygon smart contract address
0xFdfB8c4e827c2d053749C8F2f2058548dde0d073 Sample 1 Polygon smart contract address
0x75cD25791A60ab3451E2d2feB5ec46c6f541C2B8 Sample 2 Polygon smart contract address
0xb0874252a7359AA701F3F144A1f03A6e0DA8aE6D Sample 3 Polygon Smart Contract address
0xcaf2c54e400437da717cf215181b170f65187abf LenAI’s primary smart contract address

Source: The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications