reported in the wild
recover Shark Stealer's C2
pattern observed across the year
Threat actors continuously look for infrastructure that is difficult to disrupt, easy to access, and unlikely to raise immediate suspicion. One technique that fits that profile is EtherHiding: storing malicious code, configuration data, or infrastructure information on public blockchains and retrieving it through legitimate API services.
In the December edition of VMRay's Detection and Intelligence Highlights webinar, VMRay Labs threat researcher Julian Wolf explored how Shark Stealer uses EtherHiding to retrieve encrypted command-and-control (C2) information from the BNB Smart Chain. The session also covered new VMRay Threat Identifiers (VTIs), YARA detections, CAPTCHA-related analysis improvements, and new detection coverage for suspicious Visual Studio Code extensions.
The Shark Stealer case is particularly relevant for defenders because it illustrates a broader shift in threat intelligence: the most useful indicators are not always conventional malicious domains or IP addresses. Sometimes, the most durable detection opportunities come from understanding how malware retrieves the infrastructure it needs to operate.
EtherHiding: Using the Blockchain as Malware Infrastructure
EtherHiding is not a new technique. It was publicly reported in 2023 in connection with ClearFake, where threat actors stored malicious JavaScript on public blockchains and retrieved it through API services.
The basic idea is straightforward: instead of hosting malicious content on traditional attacker-controlled infrastructure, threat actors place information inside a blockchain smart contract. Malware or malicious scripts can then query the blockchain and recover that information through legitimate infrastructure.
Harder-to-Remove Infrastructure
Data stored on a public blockchain is significantly more difficult to remove than content hosted on a conventional malicious server.
Legitimate-Looking Network Traffic
Malware can initially interact with legitimate blockchain infrastructure or API endpoints rather than an obviously malicious domain.
Infrastructure Flexibility
Threat actors can update information in a smart contract without necessarily rebuilding or redistributing every deployed malware sample.
Campaign-Level Potential
Smart contracts, creator addresses, timestamps, and funding relationships create additional infrastructure pivots for CTI teams.
Inside the Shark Stealer Configuration Chain
In the sample demonstrated during the webinar, the malware first contacted a Binance-hosted API endpoint associated with the BNB Smart Chain testnet.
The malware issued an RPC request to access a particular smart contract. The response largely consisted of a hexadecimal value containing encrypted information.
That response alone was not sufficient to identify the C2 server. Shark Stealer uses AES-CFB encryption, with the required decryption key embedded in the executable.
VMRay's configuration extractor automates this process by recovering the relevant values from both the executable and observed network traffic.
The result is the actual C2 server that Shark Stealer subsequently attempts to contact.
Why the Blockchain API May Be More Valuable Than the C2
At first glance, the final decrypted C2 address appears to be the most useful indicator. From a detection perspective, however, the earlier blockchain interaction may be even more interesting.
During VMRay's analysis, the API endpoint used to access the smart contract remained stable across Shark Stealer activity observed throughout the year. Without access to that blockchain-hosted configuration, the malware cannot retrieve its C2 server.
Detection opportunity: how malware accesses its infrastructure can sometimes provide a more durable behavioral indicator than the rapidly rotating C2 infrastructure itself.
Traditional attacker infrastructure can rotate quickly. Domains disappear. IP addresses change. New servers appear. But a malware family that consistently relies on the same access mechanism creates a behavioral indicator that can remain useful even as the infrastructure behind it changes.
Blockchain Data Also Opens New CTI Pivots
Blockchain infrastructure introduces challenges for defenders, but it also creates investigative opportunities.
Because blockchain transactions and smart-contract activity are observable, analysts can examine:
- Smart contract creation dates
- Contract modifications
- Related blockchain addresses
- Funding activity
- Infrastructure changes over time
- Relationships between contracts used across malware samples
During the webinar demonstration, VMRay researchers used the BNB Smart Chain explorer to examine Shark Stealer-related smart contracts and their creators. That made it possible to gain visibility into when parts of the campaign infrastructure appeared and whether activity was continuing.
EtherHiding Is Resilient—but Not Invisible
The term EtherHiding can make blockchain-based infrastructure sound nearly impossible to disrupt. The reality is more nuanced.
The underlying blockchain may be decentralized, but malware still needs a practical mechanism for accessing it. If a campaign repeatedly depends on one particular API provider or endpoint, that access path becomes a potential defensive choke point.
This creates an important tradeoff for attackers. Blockchain storage can make configuration data difficult to remove, but the mechanism used to retrieve that data may itself become highly recognizable.
Beyond Shark Stealer: New VMRay Detection Highlights
The webinar also highlighted several new detection capabilities designed to expose increasingly evasive malware and phishing techniques.
Direct System Calls
New VMRay Threat Identifier coverage detects activity involving direct system calls commonly associated with attempts to bypass user-mode API hooking and security monitoring.
System Utility Masquerading
Another VTI identifies dropped files attempting to resemble legitimate system utilities through familiar or misleading filenames.
Branded CAPTCHA Detection
VMRay now identifies combinations of CAPTCHA behavior and brand impersonation used to increase trust in malicious web pages.
Suspicious VS Code Extensions
New static YARA coverage can identify suspicious extensions even when the execution environment required for complete dynamic analysis is unavailable.
Fake CAPTCHAs Continue to Drive Initial Access
CAPTCHA-related threats extend beyond simple visual impersonation. The webinar also highlighted fake CAPTCHA and fake verification workflows that require victims to perform actions such as copying commands, pasting them into a system interface, or following supposed verification steps.
These interaction-heavy techniques became particularly prevalent during 2025 and were frequently used as initial-access mechanisms leading to information-stealer payloads.
VMRay continues to expand its analysis capabilities around these workflows through multiple detection layers, including improvements to automated UI interaction and additional YARA coverage.
Malicious VS Code Extensions Expand the Supply-Chain Attack Surface
Another area receiving new VMRay detection coverage is suspicious Visual Studio Code extensions.
Malicious extensions present a particular sandboxing challenge. Proper dynamic analysis may require the correct development environment, an installed Visual Studio Code instance, and the extension to execute under the conditions it expects.
VMRay is therefore adding static YARA detections that can identify suspicious extensions even when complete dynamic execution is not possible.
From Malware Detection to Actionable Threat Intelligence
The broader theme running through the webinar is that detection and threat intelligence are increasingly intertwined.
A malware sample does not only answer the question: "Is this malicious?"
It can also reveal:
- Which behaviors define the malware family
- Which infrastructure it depends on
- Which configuration values control its operation
- Which techniques remain stable across samples
- Which indicators can support hunting or blocking
- How campaign infrastructure evolves over time
The key shift: malware analysis becomes most valuable when behavioral, configuration, and infrastructure evidence is transformed into intelligence that defenders can operationalize.
Key Takeaways for SOC and CTI Teams
Look Beyond Traditional IOCs
API endpoints, configuration-retrieval mechanisms, smart-contract interactions, and behavioral sequences may provide more durable detection opportunities than individual hashes, IPs, or domains.
Combine Analysis Layers
Recovering Shark Stealer's final C2 requires linking executable analysis, network behavior, and external blockchain-hosted data.
Examine Trusted Services
Blockchain APIs, cloud infrastructure, and developer platforms can all form part of malicious execution chains.
Automate Configuration Extraction
Automated extraction can turn encrypted or externalized malware configuration into immediately usable C2 and CTI artifacts.
Turning Detection Into Intelligence
EtherHiding illustrates an increasingly important reality for defenders: attacker infrastructure does not have to look malicious.
A Shark Stealer sample may begin its network activity by communicating with legitimate blockchain infrastructure. The truly malicious C2 address only emerges after encrypted information from a smart contract is combined with a key stored elsewhere in the malware.
Viewed one connection at a time, the activity can appear fragmented. Viewed as a complete behavioral chain, the intent becomes clear.
That ability to connect malware behavior, network communication, configuration extraction, and campaign infrastructure is what transforms sandbox analysis from a verdict engine into a source of operational threat intelligence.
See VMRay Threat Intelligence in Action
Discover how VMRay turns evasive malware behavior, configuration data, and infrastructure relationships into actionable intelligence for SOC, DFIR, and CTI teams.