Topic starter
23/10/2026 12:48 am
TL;DR: ChainScript traces a Node.js RAT that uses malicious installers, hidden launch stages, and a Polygon-based resolver to rotate WebSocket command infrastructure while keeping the agent consistent, according to Blackpoint Cyber’s analysis. The pattern shows why indicator-led detection fails when malware separates payload behaviour from its backend control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Blackpoint Cyber: “ChainScript: Tracing a Node.js RAT Through the Blockchain”.
By the numbers:
- The analyzed build targeted contract 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 on chain ID 137.
Key questions
Q: What failure mode does a blockchain-based C2 resolver create for defenders?
A: It breaks the assumption that command infrastructure is fixed long enough to block or sinkhole reliably.
Q: Why do user-level scheduled tasks and Run keys matter in RAT investigations?
A: They let the malware persist without administrator rights and without creating noisy system-wide changes.
Q: What do security teams get wrong about malware that uses fake software installers?
A: They often focus on the file name or lure rather than the execution chain.
Practitioner guidance
- Hunt for staged launch artefacts Prioritise ._agent.vbs, appsrcindex.js, connect-delay-state.json, and bundled Node.js runtimes under %LOCALAPPDATA% or %APPDATA%.
- Baseline user-context persistence objects Review hidden scheduled tasks and HKCU Run entries that point to wscript.exe or other script launchers.
- Correlate blockchain lookups with WebSocket registration Alert when endpoints make unexpected Polygon or EVM RPC requests and then open outbound WebSocket connections.
Bottom line: ChainScript combines a fake software installer, hidden launch stages, and user-level persistence to deliver a Node.js RAT that is designed to blend into ordinary endpoint activity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →