EtherHiding C2 Resolution
Malware stores C2 domains in Ethereum smart contracts. The blockchain is immutable, uncensorable, and anonymous defenders can't take it down. This demo queries a live contract and decodes the ABI-encoded response.
Malware
Infected host
➞
Ethereum RPC
eth_call (read-only)
➞
Smart Contract
Returns C2 domain
Selector Toolkit
keccak256 ↔ 4byte lookup
Function → Selector
Function
Selector → Function (Reverse Lookup)
Selector
Target Contract
Preset
RPC URL
Contract
Selector