Breaking down EtherRAT recovered from a The Gentlemen staging server. The MSI drops a Node.js bootstrapper, a decoder/persistence component, and an XOR-encrypted backdoor. The decoder uses a repeating XOR key with a position-dependent operation, writing the decrypted payload to disk, then sets a Run key to relaunch it through headless conhost.
C2 resolution runs off an Ethereum smart contract. Hardcoded in the sample are the contract address, a lookup key and a call function selector, with several public Ethereum RPC endpoints for redundancy. It polls the contract roughly every five minutes for a new C2.
Tasking model: each host gets a UUID bot ID separate from a hardcoded build ID. Polling generates random file-like paths (png, jpg, css, ico, webp) with random parameters to blend in. Any response over ten characters is passed to a newly constructed async function with access to require, process, Buffer, console, __dirname, __filename and log, so arbitrary JS in the user context. Requests hold up to 120 seconds, then a ~500ms gap before the next poll.
Full technical write-up, hashes and IOCs:
SOCIAL SHARE CARD GENERATOR