> ChainScript: the RAT that hides its command server inside a blockchain contract

Blackpoint uncovers ChainScript, a Node.js RAT that queries a Polygon smart contract to find and rotate its command server. Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript. The malicious code is a previously undocumented Node.js remote access trojan that hides its command server on a public blockchain. The infection starts with a familiar ClickFix trick. The victim gets talked into pasting and running a command that fires up msiexec.exe, which pulls down an installer dressed up as Spotify. Inside that installer sits a full Node.js runtime and a JavaScript agent ready to launch. Once it runs, the installer scatters its pieces across folders with Microsoft-sounding names, blending into the rest of the system. A hidden PowerShell script kicks off a VBScript file, which then starts the bundled Node.js runtime. None of this needs admin rights, since the installer is set to run entirely within the user’s own profile. The main part of the malware is contained in a single file: app\src\index.js. This file does almost everything. It handles the configuration, collects information about the infected computer, finds the command server, manages WebSocket connections, runs commands, updates the malware and cleans things up. The other components, including the PowerShell and VBScript files and the helper binaries, are mainly there to launch this file and make sure it stays running. The interesting part is how ChainScript finds its command server. Instead of having a fixed server address that security teams could block, the malware asks a smart contract on the Polygon blockchain for the address. It sends a request to the contract, gets an address back and then connects to it. This technique is known as EtherHiding. It is not a new idea, but ChainScript uses it effectively. The malware contacts the smart contract and receives a string starting with ws:// or wss://. It then saves that address for five minutes and uses it to connect to the attackers’ server. If the attackers want to move to a different server, they only need to update the smart contract. They don’t have to change or rein “For C2 discovery, ChainScript uses an EtherHiding style technique that treats a Polygon smart contract as the authoritative resolver for the active WebSocket panel. The analyzed build targeted contract 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 on chain ID 137 and supplied function selector 0x4ab7874e in an eth_call request.” read the report published by Blackpoint’. “ChainScript ABI decodes the returned string, verifies that it begins with ws:// or wss://, caches the result for five minutes, and uses it in place of the panel value stored directly in the configuration”  Blackpoint watched this play out live. During analysis, the contract first pointed the agent to one server, which stayed active for about 18 minutes while exchanging heartbeat traffic. Twelve minutes after the connection reset, the same contract handed back a completely different address, proving the backend can rotate without anyone ever updating the malware itself. One detail, flagged by an independent researcher on GitHub, is almost funny given the stakes. The smart contract behind one sample was deployed just 23 seconds before the installer was compiled. That’s too tight a window for a human to have done it by hand. Contract creation is almost certainly baked into the same build pipeline that produces the malware. Once connected, ChainScript doesn’t just sit and listen. It hands operators a full interactive shell, file read and write access, desktop screenshots, the ability to push additional payloads, a scan for installed crypto wallets, arbitrary JavaScript execution, and a self-update function. That’s complete control of the machine, with a cleanup command built in for when the job is done. On the wallet front, the malware stops at reconnaissance. It lists which wallets are installed and where, but there’s no dedicated code for stealing seed phrases or private keys. Given the shell access it already has, that distinction matters less than it should. Blackpoint found the same agent wearing different outfits. Alongside the Spotify build, other versions turned up posing as Zoom Workplace and Microsoft Teams, each with its own package name but the same code underneath. The costume changes. The thing wearing it doesn’t. “The malware was uncovered while investigating ClickFix activity that led to the execution of a malicious Windows Installer disguised as Spotify software.” reads the report. “Once executed, the MSI deployed its own Node.js runtime and launched a JavaScript agent through hidden PowerShell and VBScript stages. The running agent then established persistence in the user profile.” This isn’t happening in isolation either. Research into other malware families, Tsundere and EtherRAT among them, has already documented the same recipe: Node.js, a malicious installer, and blockchain-based server discovery. The pattern keeps showing up, and that’s the uncomfortable part. Splitting the malware from its infrastructure is turning into a design choice, not a one-off trick. For defenders, this changes where they should focus their attention. Tracking domains and IP addresses is still useful, but those indicators may not stay valid for long if the attackers can simply change the blockchain contract. Looking at the chain of processes can be much more effective: msiexec starting wscript, wscript launching the VBScript, and node.exe running app\src\index.js. These relationships are much harder for attackers to change than the server address they happen to be using this week. Defenders should also watch for less obvious signs of activity. For example, a node.exe process suddenly making outbound blockchain RPC requests and then opening a WebSocket connection should attract attention. Neither of these behaviors is necessarily malicious on its own. But when they happen together, they become a much stronger indicator of compromise than simply looking for a specific domain or IP address on a blocklist. “ChainScript combines familiar RAT functionality with a flexible C2 design built around blockchain based infrastructure discovery.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)