Loading malware…
ChainScript is a Node.js remote-access trojan targeting Windows systems. Identified by Blackpoint Cyber’s Adversary Pursuit Group during ClickFix investigations, it is distributed through malicious Windows Installer packages impersonating Spotify, Zoom Workplace, Microsoft Teams, and application runtimes. Victims are induced to execute commands that use Windows Installer to retrieve the packages. Hidden PowerShell and VBScript stages launch a bundled Node.js runtime and JavaScript agent. Installation operates in the current user’s context without requiring administrator privileges.
ChainScript provides interactive CMD and PowerShell sessions, file enumeration and transfer, file modification and deletion, screenshot capture, arbitrary JavaScript execution, and additional payload deployment. It also supports self-updating and removal of its persistence and local components. The agent collects host information and inventories desktop cryptocurrency wallets and browser wallet extensions. Examined builds lack dedicated functions for stealing wallet seed phrases, private keys, browser passwords, or cookies, although their general-purpose remote-access capabilities permit operator-directed collection. Persistence uses a scheduled task, with a user-level registry Run entry as a fallback. Concealed execution and Microsoft-themed component placement help the malware blend into legitimate system activity.
ChainScript communicates with its command server over WebSockets. Earlier builds use an EtherHiding-style mechanism that queries a Polygon smart contract to retrieve the active command-server address, caching the result for five minutes. This permits operators to rotate infrastructure without modifying deployed agents, and live server rotation has been observed. A subsequently identified build configures its command-server address directly while retaining scheduled-task persistence. Observed delivery relies on social engineering rather than exploitation of a software vulnerability.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
L’infection débute par une activité ClickFix.
“ChainScript establishes persistence through a scheduled task named ComponentTask33Agent.”
“The MSI presents itself as Spotify software and launches hidden PowerShell and VBScript stages.”
“the RAT gives attackers broad control of the system, including interactive CMD and PowerShell sessions.”
“The MSI presents itself as Spotify software and launches hidden PowerShell and VBScript stages.”
“the RAT gives attackers broad control of the system, including ... remote JavaScript execution.”
“The infection starts with a familiar ClickFix trick. The victim gets talked into pasting and running a command...”
“the attack starts with ClickFix instructions that persuade a victim to run a command through Windows tools.”
“ChainScript establishes persistence through a scheduled task named ComponentTask33Agent.”
“with a Windows Run key used as a fallback.”
“ChainScript establishes persistence through a scheduled task named ComponentTask33Agent.”
“with a Windows Run key used as a fallback.”
“ChainScript first Base64 decodes the file, XORs the resulting bytes using a buildSeed value ... and parses the recovered JSON.”
“The MSI presents itself as Spotify software” and other builds were “disguised as Zoom Workplace and Microsoft Teams.”
Le MSI malveillant se présentant comme Spotify ... disperse ses composants dans des chemins imitant des répertoires Microsoft légitimes.
“...a cleanup command built in for when the job is done.”
TTP # ... T1140 — Deobfuscate/Decode Files or Information (Defense Evasion).
“The command uses msiexec.exe to retrieve ComponentTask33-4d14e6ac.msi from attacker-controlled infrastructure.”
“[The agent] registers details including ... local IPv4 address, and domain or workgroup information.”
“It handles the configuration, collects information about the infected computer...”
“the RAT gives attackers broad control of the system, including ... file browsing and transfer.”
“It also performs wallet discovery by identifying installed desktop wallets and browser wallet extensions.”
Gestion de fichiers (énumération, lecture, écriture, suppression, transfert Base64) ... Découverte de wallets crypto.
“the RAT gives attackers broad control of the system, including ... screenshots.”
“The contract returns the WebSocket address currently used by the operators” and “provides a stable way for deployed agents to locate whichever WebSocket panel is active.”
pour résoudre dynamiquement l’URL du panneau WebSocket actif.
“The malware uses an EtherHiding style C2 discovery technique that relies on a Polygon smart contract to locate its active WebSocket infrastructure.”
“the malware queries a Polygon smart contract using an EtherHiding-style technique. The contract returns the WebSocket address currently used by the operators.”
“For C2 discovery, ChainScript uses an EtherHiding style technique that treats a Polygon smart contract as the authoritative resolver for the active WebSocket panel.”
“the RAT gives attackers broad control of the system, including ... payload execution, updates.”
“ChainScript is a full featured RAT that gives operators broad control over an infected system.”
“Instead of having a fixed server address... the malware asks a smart contract on the Polygon blockchain for the address.”
Le contrat Polygon a d’abord résolu shift-api-control[.]com:3847, puis ... bedotiq[.]net:3854.
Gestion de fichiers (énumération, lecture, écriture, suppression, transfert Base64).
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.