Hackers Abuse Ethereum Smart Contracts to Hide Amatera Stealer C2 Servers

This report details an active campaign using trojanized archives and a Ren'Py-based loader (RenPy/RenEngine Loader) to deliver Amatera Stealer and other payloads; the loader performs sandbox checks, uses LOLBIN techniques (forfiles.exe, MSBuild.exe), reconstructs a trojanized Nancy.NET in memory, and employs heavy obfuscation. Notably, the campaign uses an EtherHiding technique—querying an Ethereum JSON-RPC endpoint to retrieve encrypted C2 information—making takedown and detection more difficult. Distribution occurs via malicious and spoofed download sites and popular file-sharing platforms, and the report includes multiple domains and IPs as IOCs.