Updated October 30, 2026: the analyzed samples are now on MalwareBazaar, and we added netpatch.msi, a possible earlier variant. The details are in the update near the end of this post.
EtherSnake is a Windows installer that scored 0 detections on VirusTotal and installs a Python backdoor that reads its command-and-control (C2) address from an Ethereum smart contract. The operator has set that address seven times since deploying the contract on October 16, an initial value and six changes, and every infected machine follows each change. Snoopy Triage, Tuxxin's threat analysis platform, extracted every stage and decrypted the payload on October 29, 2026 without running it.
How the sample surfaced
On October 29, 2026, @malwrhunterteam posted the sample, served from Azure hosting at hxxps://octoberfp.eastus.cloudapp.azure[.]com/files/KB59985. VirusTotal showed 0 detections, and its Code Insight summary said the MSI had "no active components, scripts, or installation routines". @smica83 uploaded it to MalwareBazaar. Snoopy Triage picked it up from a public feed.
The infection chain
1. The MSI
The installer is 36 KB, built with WiX on October 28 at 14:45 UTC, with random product and manufacturer names. It unpacks four files into a random folder under %LOCALAPPDATA%:
DeployFinalize.cmd- a two-line VBS helper
- a Python loader
- an encrypted
.binfile
A deferred, asynchronous custom action runs DeployFinalize.cmd after the install finishes. A hidden shortcut in the Startup folder runs it again at every logon.
2. DeployFinalize.cmd
The script is padded with fake corporate-deployment comments. It downloads the official embeddable Python 3.12.3 from python.org, with the URL stored in base64, and unpacks it with the Windows tar.exe. It renames pythonw.exe to ConfigEngine.exe and starts it hidden through the VBS helper.
Each file a scanner sees on its own is either legitimate software or meaningless data. That explains the zero detection score.
3. The loader
The Python loader XORs the .bin file with a 32-byte key and each byte's position, then passes the result to exec(), so the decrypted backdoor runs in memory.
4. The backdoor
The backdoor is written in Python and carries code paths for both Windows and Linux.
- It reads its C2 address from an Ethereum smart contract. It asks nine public RPC providers and takes the majority answer. The lookup key is the operator's wallet address.
- It polls
/api/<random>/<bot id>/<random>.png?id=<build id>, or the same path ending in .jpg, .gif, .css, .ico or .webp, and sends the headerX-Bot-Type: python. - It runs any Python code the server returns, with shell and socket access.
- It persists through a Startup file named
MicrosoftEdgeUpdate.cmdand a logon task namedMicrosoftEdgeUpdateTaskfollowed by four hex characters. - It disables TLS certificate checks.
The C2 lives on Ethereum
The contract is 0x41179162599919ad4eadcabc2cfefc1133269c2c on Ethereum mainnet. The operator wallet, 0xeb7d120ea01d624e4fc8d3cf8e90595d55083d06, has 8 transactions: the contract deployment and 7 writes of the C2 address. The first write set the initial C2 three blocks after deployment, and the other 6 changed it.
The operator can move the C2 at any moment with one transaction, and every bot follows. The same design gives defenders a full public record: every C2 the operator ever set is readable on-chain.
| # | UTC | C2 written to the contract | Note |
|---|---|---|---|
| 1 | 2026-10-16 20:37 | hxxps://zone-14-service-8-8.eastus.cloudapp.azure[.]com |
Initial value, just after deployment |
| 2 | 2026-10-27 22:10 | hxxps://sigmauperdonesoft[.]com |
|
| 3 | 2026-10-28 06:54 | hxxps://zone-14-service-8-8.eastus.cloudapp.azure[.]com |
|
| 4 | 2026-10-28 09:53 | hxxps://sigmauperdonesoft[.]com |
|
| 5 | 2026-10-28 10:04 | hxxps://zone-14-service-8-8.eastus.cloudapp.azure[.]com |
|
| 6 | 2026-10-28 10:57 | hxxps://westusserverfor.westus2.cloudapp.azure[.]com |
|
| 7 | 2026-10-29 14:13 | hxxps://esastus-oct29.eastus.cloudapp.azure[.]com |
Current |
The sample also carries a built-in backup C2, october28floor.eastus.cloudapp.azure[.]com. The last switch came about 4.5 hours before the public post.
sigmauperdonesoft[.]com was registered on October 27 and pointed at 172.233.158[.]8 (Linode), with Cloudflare DNS. softportalone[.]com was registered the same day and shares that IP. We found no evidence it served as a C2.
Every host in this campaign was created by the attacker. No compromised websites are involved.
Why the name EtherSnake
The design mirrors EtherRAT, a Node.js implant Sysdig documented in December 2025: C2 stored on-chain, a majority vote across nine RPC providers, the wallet as the lookup key, and a download of an official language runtime. We found no shared code and make no attribution claim. "EtherSnake" names this Python implant only.
Indicators
Cloud IPs get reassigned quickly, so the hostnames and hashes are the lasting indicators.
SHA256
| Hash | File |
|---|---|
a6ecbf30583cf4e81c67d13d1f8917e18ab75a149191a3e8628f522d45312be0 |
MSI |
3aaaa49a0c4b139a8098b27dba31235571f68b32d96e25669e7febe6c82976d9 |
DeployFinalize.cmd |
61d6b309d9774d13d632322816260e082f96293087333e7a379310e7b0796be0 |
VBS helper |
905e2e48e90e0d4aa332e7c39e9d7a41407fdc5bc78bad14c46294ec5c08b784 |
Python loader |
d79112cd7e8107719c63f901896f74154d5cf3d8aa20937c4ecb2f56ae28db46 |
Encrypted .bin |
a0501b667a166efa07bfa4f376d24e97948c68661a13e37ce6a6029edcbee0aa |
Decrypted backdoor |
Hosts and IPs
| Host | IP | Role |
|---|---|---|
octoberfp.eastus.cloudapp.azure[.]com |
172.174.116[.]94 |
Payload host |
zone-14-service-8-8.eastus.cloudapp.azure[.]com |
4.246.227[.]107 |
C2 |
sigmauperdonesoft[.]com |
172.233.158[.]8 |
C2 |
westusserverfor.westus2.cloudapp.azure[.]com |
20.94.232[.]24 |
C2 |
esastus-oct29.eastus.cloudapp.azure[.]com |
20.55.89[.]207 |
C2 (current) |
october28floor.eastus.cloudapp.azure[.]com |
172.174.235[.]40 |
Backup C2 |
softportalone[.]com |
172.233.158[.]8 |
Sibling domain |
On-chain
- Contract:
0x41179162599919ad4eadcabc2cfefc1133269c2c(Ethereum mainnet) - Operator wallet:
0xeb7d120ea01d624e4fc8d3cf8e90595d55083d06
Detection
-
pythonw.exe, or any process namedConfigEngine.exe, connecting to public Ethereum RPC providers. - The header
X-Bot-Type: pythonin proxy or web server logs. - Logon tasks named
MicrosoftEdgeUpdateTaskplus hex characters that point to a Python runtime under%LOCALAPPDATA%, and a Startup file namedMicrosoftEdgeUpdate.cmd. - An MSI custom action that runs a
.cmdfile from its own install folder.
On an infected host: isolate it, remove the logon task, the Startup files and the %LOCALAPPDATA% folder, and treat every credential used on that machine as exposed.
Update, October 30, 2026
Samples on MalwareBazaar
The four files we analyzed are now public on MalwareBazaar with the tag EtherSnake, next to the MSI that @smica83 reported. The links are in the list at the end of this post. The decrypted backdoor is the payload decrypted from Ac2cwRJF6zPS.bin; on a victim it only ever runs in memory.
A possible earlier variant: netpatch.msi
netpatch.msi is a 32 KB WiX MSI with the product name "FactAuth", built on October 27, 2026. @smica83 posted it on MalwareBazaar on October 29, and @malwrhunterteam shared it the same day. It was hosted on Azure blob storage at buildpoint.blob.core.windows[.]net/stackguard/netpatch.msi, and the file has since been removed.
The link to EtherSnake rests on design overlap alone. The two share no wallet, server or code, so we call netpatch a possible earlier variant and nothing stronger.
How netpatch works
- A custom action runs
ins.cmd. It downloads the official embeddable Python 3.14.3 from python.org into a random nine-letter folder under%LOCALAPPDATA%, installs pip, and pip-installsweb3,pywin32,pythonnet,pywinptyandwebsockets. -
get_message.pyuses web3 to callgetMessage()on an Ethereum Sepolia testnet contract,0x86bdF9F8D5fD58C53018a7C797Bd50d4ca6C1A1f, and writes the answer, the C2 host, toML.txt. - A one-line
pythonw.execommand, with its strings split apart, pollshttps://<C2>/<6 random letters>/<9 random letters>?v=6with certificate checks off. It runs the Python code in thecfield of the JSON reply. -
start.cmdrepeats this at every logon.
The contract's current C2 is deployment.eastus.cloudapp.azure[.]com (20.55.80[.]190), written on September 22, 2026.
netpatch on-chain history
The deployer wallet, 0x378ba15a67666137D8158b4EfaBF71B3EAfdDeCB, was funded with test ETH on June 21, 2026. In June it built and tested a two-way message channel on Sepolia: a contract named MessageQueue with sendToServer, sendToClient and clearServerMessages calls.
On September 20, 2026 the wallet deployed the netpatch contract and wrote "Hello from Python!" to it as a test. On September 22 it wrote the Azure C2.
Why it may be related
- Both are small WiX MSIs.
- Both stage the official python.org embeddable runtime in a random
%LOCALAPPDATA%folder. - Both read their C2 host from an Ethereum contract.
- Both use Azure East US cloudapp hosts for C2.
- Both run whatever Python the C2 returns, with TLS verification off.
- Both surfaced the same week.
The netpatch contract predates EtherSnake's first contract, deployed October 16. netpatch looks like a simpler build: a testnet instead of mainnet, one RPC provider instead of a nine-provider vote, and no encrypted stage.
What we can't show
- No wallet, server or code is shared with EtherSnake.
- The Sepolia wallets have never been used on mainnet, and the EtherSnake wallets have never been used on Sepolia.
- Blockchain-hosted C2 is common enough that a separate actor is possible.
netpatch indicators
| Type | Value | Note |
|---|---|---|
| SHA256 | acd083343625712a2116d2480cdf9e80af72338b7653590d03b109b60708742b |
netpatch.msi |
| SHA256 | 64ac14cde7dc19a6f57ec14ddeb9f4404c559968472080a8bc5644dc067858b9 |
ins.cmd |
| SHA256 | 85b4a507984b89be7378a64affb762712b25544a00b18d0b187d7816519490a6 |
start.cmd |
| SHA256 | c0fdefe243f17f89b1b4b2dd93574b52b3509c87a80123209222a6724a77e047 |
get_message.py |
| Sepolia contract | 0x86bdF9F8D5fD58C53018a7C797Bd50d4ca6C1A1f |
getMessage() returns the C2 |
| Sepolia wallet | 0x378ba15a67666137D8158b4EfaBF71B3EAfdDeCB |
Deployer and writer |
| Host | buildpoint.blob.core.windows[.]net |
Payload host |
| Host | deployment.eastus.cloudapp.azure[.]com |
C2, 20.55.80[.]190
|
Detecting netpatch
- Endpoints that run pip or web3 from a Python folder under
%LOCALAPPDATA%. - A file named
ML.txtnext topythonw.exein that folder.
Shared publicly
- AlienVault OTX pulse with 33 indicators, including netpatch
- URLhaus: the payload URL
- ThreatFox: 5 C2 hosts tagged EtherSnake
- MalwareBazaar, tagged EtherSnake:
- The MSI, reported by @smica83
- DeployFinalize.cmd
- run1w7zzg.vbs, the VBS helper
- xBoInRMFWK.py, the XOR loader
-
The decrypted backdoor stage, decrypted from
Ac2cwRJF6zPS.bin; on a victim it only ever runs in memory
Thanks to @malwrhunterteam for spotting and posting the sample, and to @smica83 for sharing it on MalwareBazaar. Analysis by Snoopy Triage.
Top comments (0)