Malware I got infected with (out of curiosity)
11 hours ago
- A macOS infostealer loader uses the EtherHiding technique, storing its C2 address in a blockchain smart contract instead of hardcoding it, making it resistant to takedown.
- Persistence is achieved by writing a LaunchAgent plist that loads at login and relaunches if killed, with the script encoded in base64 and piped to osascript to avoid disk traces.
- The loader resolves its C2 from the Polygon blockchain via JSON-RPC eth_call to a specific contract, disguising traffic as benign crypto activity and allowing the attacker to change the C2 by updating the contract.
- Stage 2 is fetched via a curl POST request and executed directly by osascript, enabling arbitrary remote code execution that can be refreshed on every login.