SharkStealer Adopts EtherHiding Technique for C2 Communication Evasion

SharkStealer, a Golang-based information stealer, has been observed adopting an EtherHiding technique to conceal its command-and-control (C2) communications on the Binance Smart Chain (BSC) Testnet, as of 22 October 2025. According to GBHackers On Security, the malware uses Ethereum RPC calls to retrieve C2 details from a smart contract and decrypts the payload in memory, allowing it to contact a C2 endpoint while blending with legitimate blockchain traffic.

The technique relies on eth_call requests to a BSC Testnet node, with the contract returning a two-part tuple containing a cryptographic initialization vector and an AES-CFB encrypted blob that encodes the actual C2 endpoint.

Indicators of compromise include the BSC Testnet RPC endpoint https://data-seed-prebsc-1-s1.binance[.]org:8545, the smart contract address 0xE7E24F1A3D9C5B7E8A6D2F4C3B9A8E5F1D2C3B4, and the embedded AES key 0123456789ABCDEF0123456789ABCDEF, along with a sample C2 domain attacker-c2.example[.]com and sample C2 IP 198.51.100[.]23.