EtherSnake: a zero-detection MSI that hides its C2 on Ethereum

EtherSnake is a Windows installer that scored 0 detections on VirusTotal and installs a Python backdoor that reads its command-and-control (C2) address from an Ethereum smart contract. The operator has set that address seven times since deploying the contract on October 16, an initial value and six changes, and every infected machine follows each change. Snoopy Triage, Tuxxin's threat analysis platform, extracted every stage and decrypted the payload on October 29, 2026 without running it.

How the sample surfaced

On October 29, 2026, @malwrhunterteam posted the sample, served from Azure hosting at hxxps://octoberfp.eastus.cloudapp.azure[.]com/files/KB59985. VirusTotal showed 0 detections, and its Code Insight summary said the MSI had "no active components, scripts, or installation routines". @smica83 uploaded it to MalwareBazaar. Snoopy Triage picked it up from a public feed.

The infection chain

1. The MSI

The installer is 36 KB, built with WiX on October 28 at 14:45 UTC, with random product and manufacturer names. It unpacks four files into a random folder under %LOCALAPPDATA%:

• DeployFinalize.cmd
• a two-line VBS helper
• a Python loader
• an encrypted .bin file

A deferred, asynchronous custom action runs DeployFinalize.cmd after the install finishes. A hidden shortcut in the Startup folder runs it again at every logon.

2. DeployFinalize.cmd

The script is padded with fake corporate-deployment comments. It downloads the official embeddable Python 3.12.3 from python.org, with the URL stored in base64, and unpacks it with the Windows tar.exe. It renames pythonw.exe to ConfigEngine.exe and starts it hidden through the VBS helper.

Each file a scanner sees on its own is either legitimate software or meaningless data. That explains the zero detection score.

3. The loader

The Python loader XORs the .bin file with a 32-byte key and each byte's position, then passes the result to exec(), so the decrypted backdoor runs in memory.

4. The backdoor

The backdoor is written in Python and carries code paths for both Windows and Linux.

• It reads its C2 address from an Ethereum smart contract. It asks nine public RPC providers and takes the majority answer. The lookup key is the operator's wallet address.
• It polls /api/<random>/<bot id>/<random>.png?id=<build id>, or the same path ending in .jpg, .gif, .css, .ico or .webp, and sends the header X-Bot-Type: python.
• It runs any Python code the server returns, with shell and socket access.
• It persists through a Startup file named MicrosoftEdgeUpdate.cmd and a logon task named MicrosoftEdgeUpdateTask followed by four hex characters.
• It disables TLS certificate checks.

The C2 lives on Ethereum

The contract is 0x41179162599919ad4eadcabc2cfefc1133269c2c on Ethereum mainnet. The operator wallet, 0xeb7d120ea01d624e4fc8d3cf8e90595d55083d06, has 8 transactions: the contract deployment and 7 writes of the C2 address. The first write set the initial C2 three blocks after deployment, and the other 6 changed it.

The operator can move the C2 at any moment with one transaction, and every bot follows. The same design gives defenders a full public record: every C2 the operator ever set is readable on-chain.

The sample also carries a built-in backup C2, october28floor.eastus.cloudapp.azure[.]com. The last switch came about 4.5 hours before the public post.

sigmauperdonesoft[.]com was registered on October 27 and pointed at 172.233.158[.]8 (Linode), with Cloudflare DNS. softportalone[.]com was registered the same day and shares that IP. We found no evidence it served as a C2.

Every host in this campaign was created by the attacker. No compromised websites are involved.

Why the name EtherSnake

The design mirrors EtherRAT, a Node.js implant Sysdig documented in December 2025: C2 stored on-chain, a majority vote across nine RPC providers, the wallet as the lookup key, and a download of an official language runtime. We found no shared code and make no attribution claim. "EtherSnake" names this Python implant only.

Indicators

Cloud IPs get reassigned quickly, so the hostnames and hashes are the lasting indicators.

SHA256

Hosts and IPs

On-chain

• Contract: 0x41179162599919ad4eadcabc2cfefc1133269c2c (Ethereum mainnet)
• Operator wallet: 0xeb7d120ea01d624e4fc8d3cf8e90595d55083d06

Detection

• pythonw.exe, or any process named ConfigEngine.exe, connecting to public Ethereum RPC providers.
• The header X-Bot-Type: python in proxy or web server logs.
• Logon tasks named MicrosoftEdgeUpdateTask plus hex characters that point to a Python runtime under %LOCALAPPDATA%, and a Startup file named MicrosoftEdgeUpdate.cmd.
• An MSI custom action that runs a .cmd file from its own install folder.

On an infected host: isolate it, remove the logon task, the Startup files and the %LOCALAPPDATA% folder, and treat every credential used on that machine as exposed.

Shared publicly

• AlienVault OTX pulse with 19 indicators
• URLhaus: the payload URL
• ThreatFox: 5 C2 hosts tagged EtherSnake
• MalwareBazaar: the MSI

Thanks to @malwrhunterteam for spotting and posting the sample, and to @smica83 for sharing it on MalwareBazaar. Analysis by Snoopy Triage.