title: 'T1102.001 Dead Drop Resolver — EtherHiding Payload Retrieval from BNB Smart Chain Testnet'
id: '401dfb2d-8dab-59bf-984e-7b9344d725a6'
status: 'experimental'
description: 'Browser retrieving second-stage JavaScript from smart contracts on BNB Smart Chain testnet (chainId 97). Observed 2026-08-11 in a live compromise of a high-traffic US consumer site, where a rogue Google Tag Manager container injected an obfuscated loader that issued eth_call with selector 0x6d4ce63c (get()) against attacker-owned contracts and passed the ABI-decoded string to eval(atob(...)). Payload storage on-chain means there is no seizable C2 host and no DNS to sinkhole; the operator swaps the payload by calling the owner-gated set(string) selector 0x4ed3885e. Testnet rather than mainnet is the notable deviation from previously reported EtherHiding tradecraft — faucet-funded gas makes payload hosting and high-frequency updates free. Fires on either the RPC endpoint hostnames or the known contract addresses appearing in request URIs. The higher-fidelity variant matches JSON-RPC method eth_call plus selector 0x6d4ce63c in the POST body, which requires body-logging most proxies do not perform by default; hostname coverage is the portable fallback and is used here. Contract addresses are campaign-scoped and will rotate — the RPC hostname selection is the durable half of this rule.'
references:
    - 'https://thrunt.me/sigma/t1102-001-etherhiding-bsc-testnet-dead-drop.yml'
    - 'https://attack.mitre.org/techniques/T1102/001/'
    - 'https://cloud.google.com/blog/topics/threat-intelligence/etherhiding-financially-motivated-blockchain-malware'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-11'
modified: '2026-08-11'
tags:
    - 'attack.command_and_control'
    - 'attack.t1102.001'
    - 'attack.defense_evasion'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_rpc_endpoint:
        cs-host|contains:
            - 'bsc-testnet-rpc.publicnode.com'
            - 'bsc-testnet.drpc.org'
            - 'bsc-testnet-dataseed.bnbchain.org'
            - 'data-seed-prebsc-1-s1.binance.org'
            - 'data-seed-prebsc-1-s1.bnbchain.org'
            - 'data-seed-prebsc-2-s1.binance.org'
            - 'data-seed-prebsc-2-s2.binance.org'
            - 'bnb-testnet.api.onfinality.io'
    selection_contract:
        c-uri|contains:
            - '0xda4e1d62c974d20c870343f540bebfaac779ed66'
            - '0x1ca902fdf2f2a26dd2a160662143029cd7d5813f'
            - '0xe447dadb4bfb4610882c8d6228a20f101f8933d6'
            - '0xf4a32588b50a59a82fba148d436081a48d80832a'
    condition: '1 of selection_*'
falsepositives:
    - 'Developer or QA workstations doing legitimate BSC testnet work — smart contract development, CI deployment pipelines, or wallet integration testing. Scope this rule to non-engineering user segments, or allowlist known dev hosts, before promoting past experimental.'
    - 'Browser wallet extensions (MetaMask, Trust Wallet) with BSC testnet configured as an active network will poll these endpoints on their own.'
    - 'Security research and sandbox detonation infrastructure replaying this or similar campaigns.'
level: 'high'