Hackers Abuse Ethereum Smart Contracts to Hide Amatera Stealer C2 Servers

Hackers are increasingly abusing decentralized infrastructure and legitimate development frameworks to evade detection, with a newly observed campaign leveraging Ethereum smart contracts to conceal command-and-control (C2) endpoints for the Amatera Stealer infostealer.

These lures are propagated عبر malicious websites, file-sharing platforms such as Google Drive, MEGA, GoFile, and Wormhole, and spoofed download portals designed to mimic legitimate distribution channels.

The infection chain begins with a trojanized archive containing a Setup.exe binary. While victims are presented with a benign-looking installation interface, malicious processes execute silently in the background.

The loader abuses the legitimate Ren’Py engine commonly used for visual novels and interactive fiction to embed and execute malicious Python code, increasing the plausibility of the payload.

This campaign reflects a broader trend previously observed with frameworks like Bun and Deno, where attackers weaponize trusted development ecosystems to bypass security controls and reduce suspicion.

Similar techniques were documented in earlier campaigns distributing NwHStealer via Bun (https://www.malwarebytes.com/blog/threat-intel/2026/05/attackers-adopt-javascript-runtime-bun-to-spread-nwhstealer).

Deno-based RATs (https://www.malwarebytes.com/blog/threat-intel/2026/05/fake-software-on-github-and-sourceforge-distribute-deno-rat).

Once executed, RenPy Loader initiates a multi-stage infection chain involving obfuscated payload delivery and defense evasion.

Malwarebytes Researchers have identified multiple ongoing campaigns distributing a malware loader known as RenPy Loader (also tracked as RenEngine Loader) through fake downloads of games, cracked software, and mods.

Amatera Stealer C2 Servers

The first-stage loader extracts encrypted components from embedded resources, including XOR-protected configuration files and ZIP archives.

It performs sandbox detection checks and removes the Mark-of-the-Web flag via alternate data streams to bypass Windows SmartScreen protections.

The loader then executes a BAT script through forfiles.exe, which launches a hidden conhost.exe instance and invokes MSBuild.exe with a malicious project file (Nancy.csproj).

This technique enables execution of inline .NET payloads using MSBuild property functions, a known living-off-the-land binary (LOLBIN) abuse vector.

A trojanized version of the Nancy .NET framework is subsequently reconstructed and executed in memory. The payload employs heavy obfuscation, including custom bytecode interpretation, multi-layer XOR encryption, API hashing, and indirect function resolution.

It also modifies system network configurations, disables TLS certificate validation, and performs anti-forensics operations.

The most notable aspect of this campaign is the use of EtherHiding a technique that leverages blockchain data to store or retrieve malicious infrastructure details.

Instead of embedding the C2 address directly in the malware, the loader issues an Ethereum JSON-RPC request to a public blockchain endpoint (bsc-dataseed.binance.org), querying a smart contract to retrieve encrypted C2 information.

This significantly complicates detection and takedown efforts, as blockchain data is immutable and decentralized.

The retrieved C2 endpoint is then used to download additional payloads, including multiple obfuscated .NET and native DLLs such as PavinWide, GollopDevest, and LanoseThrip.

These components ultimately decrypt and execute the final payload: Amatera Stealer.

Amatera is a data-harvesting malware designed to extract sensitive information from infected systems, including browser-stored credentials, cryptocurrency wallet data, messaging application content, browser extensions, and local files.

Stolen session tokens and credentials can enable account takeover attacks across multiple platforms.

Notably, RenPy Loader has also been observed delivering alternative payloads such as Lumma Stealer and HijackLoader, indicating a flexible malware-as-a-service (MaaS) distribution model.

The reuse of EtherHiding infrastructure across campaigns, including ClickFix activity, further supports this assessment.

The combination of blockchain-based C2 concealment, legitimate tool abuse, and multi-stage in-memory execution highlights a growing shift toward resilient, stealth-focused malware delivery.

As attackers continue to blend decentralized technologies with trusted software frameworks, traditional detection mechanisms face increasing challenges in identifying and disrupting these campaigns.

IOCs

Indicator	Type
downpro[.]net	Fake download website
macisofile[.]sbs	Fake download website
visitmama[.]blog	Fake download website
visitmama[.]guru	Fake download website
getgamerfree[.]com	Fake download website
fullgames[.]digital	Fake download website
flingbase[.]net	Fake download website
citronemu[.]com	Fake download website
filemodo[.]xyz	Distribution infrastructure
storage06x[.]cfd	Distribution infrastructure
p03sil[.]cyou	Distribution infrastructure
wimsedas[.]xyz	Distribution infrastructure
againstmor[.]store	Distribution infrastructure
host03q[.]cfd	Distribution infrastructure
cloud01y[.]cfd	Distribution infrastructure
storage11x[.]cfd	Distribution infrastructure
storage04x[.]cfd	Distribution infrastructure
host82p[.]cfd	Distribution infrastructure
cloud05y[.]cfd	Distribution infrastructure
analyticstrack-pzh[.]click	Tracking website
login.orbitalframework[.]cc	C2 (Amatera Stealer)
144.124.251[.]171	Malicious IP (Payload delivery)
195.63.140[.]33	Malicious IP (Payload delivery)
78.40.196[.]252	Malicious IP (Payload delivery)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist